Wombat

WAF-OPS-110 – GitOps-based deployments SHOULD be preferred for Kubernetes and container workloads

Pillar: Excellence | Severity: 🟡 Medium | Category: Deployment Automation | Automatable: Medium

Description

Kubernetes and container workloads SHOULD be deployed via GitOps controllers that reconcile desired state from Git. GitOps repositories MUST enforce peer review, branch protection, and signed commits. Controllers MUST report sync status, drift, and errors to observability systems. Manual imperative changes to clusters MUST be reconciled or rejected.

Rationale

Risk Description

Risk

Imperative cluster changes bypass audit trails and create drift between environments.

Risk

Missing GitOps reconciliation leaves clusters in undocumented, non-reproducible states.

Requirements

  • Kubernetes and container workloads SHOULD be deployed via GitOps controllers that reconcile desired state from Git.

  • GitOps repositories MUST enforce peer review, branch protection, and signed commits.

  • Controllers MUST report sync status, drift, and errors to observability systems.

  • Manual imperative changes to clusters MUST be reconciled or rejected.

Implementation Guidance

  1. Document the requirement in a version-controlled policy, ADR, or standard.

  2. Assign ownership and establish a review cadence (e.g., quarterly).

  3. Implement the required configuration as code in Terraform or equivalent IaC.

Maturity Levels

Level Name Criteria

L1

Ad hoc – control not consistently applied

* Die Anforderung ist nicht einheitlich umgesetzt; Nachweis existiert nur punktuell oder fehlt.

L2

Standardised – policy defined and communicated

* Eine dokumentierte Policy oder ein Standard beschreibt die Anforderung.

L3

Integrated – automated validation in CI/CD

* Terraform-Checks oder IaC-Gates prüfen die Anforderung automatisch in CI/CD.

L4

Auditable – metrics and exceptions tracked

* Abdeckung, Ausnahmen und Qualitätsmetriken werden quartalsweise berichtet.

L5

Optimised – continuous improvement based on data

* Die Effektivität wird kontinuierlich gemessen und automatisch optimiert.

Checks

waf-ops-110.tf.aws.eks-gitops-addon

Engine: terraform | Provider: aws | Automated: Yes

AWS EKS should deploy GitOps agent via EKS add-on or Helm

AWS EKS should deploy GitOps agent via EKS add-on or Helm

Scope: resource — aws_eks_addon, helm_release

Assertions: * addon_name in ['fluxcd', 'argo-cd'] — EKS should have a GitOps add-on installed.

Remediation: AWS EKS should deploy GitOps agent via EKS add-on or Helm

Compliant
# Example compliant with waf-ops-110.tf.aws.eks-gitops-addon
Non-Compliant
# Example non-compliant with waf-ops-110.tf.aws.eks-gitops-addon

waf-ops-110.tf.azurerm.gitops-extension

Engine: terraform | Provider: azurerm | Automated: Yes

Azure AKS should use Flux extension for GitOps

Azure AKS should use Flux extension for GitOps

Scope: resource — azurerm_kubernetes_cluster_extension

Assertions: * extension_type in ['microsoft.flux'] — AKS should use microsoft.flux GitOps extension.

Remediation: Azure AKS should use Flux extension for GitOps

Compliant
# Example compliant with waf-ops-110.tf.azurerm.gitops-extension
Non-Compliant
# Example non-compliant with waf-ops-110.tf.azurerm.gitops-extension

waf-ops-110.config.gitops-policy

Engine: config | Provider: any | Automated: No

GitOps policy must be documented

GitOps policy must be documented

Scope: file — docs/devops/gitops-policy.md

Assertions: * exists attribute_exists — GitOps policy must describe repository structure and reconciliation.

Remediation: GitOps policy must be documented

Compliant
# Example compliant with waf-ops-110.config.gitops-policy
Non-Compliant
# Example non-compliant with waf-ops-110.config.gitops-policy

Evidence

  • Terraform configuration implementing the requirement.

  • Policy, ADR, or standard documenting the requirement.

  • Optional cloud console or API output confirming runtime state.

Related Controls