Project Name
All 15 Kubernetes Clusters Brought Into Consistent Policy Compliance in a Single Quarter With GitOps-Synced OPA
A US-headquartered global enterprise running 60+ microservices across a distributed fleet of 15 GitOps-managed Kubernetes clusters, spanning multiple regions and business units, each operated by teams making local decisions about security enforcement. Policy configuration had evolved independently in every location rather than from a single governed source, so a constraint applied cleanly in one cluster was quietly absent from another, and nobody held a fleet-wide view of the gap until an audit or an incident forced the question. Ksolves rebuilt policy governance as a centralised, GitOps-synced OPA distribution model, bringing all 15 clusters onto an identical policy set within a single quarter, collapsing rollout from 15 manual updates to one commit, and adding continuous drift detection across the fleet.
- Inconsistent policy across the fleet: Security constraints present on some clusters were entirely missing on others, with no single source of truth for what should be enforced everywhere.
- No fleet-wide compliance visibility: Platform teams could check one cluster at a time but had no aggregated view of policy posture across all 15 clusters.
- Manual, per-cluster policy updates: Rolling out a new or updated policy meant touching each cluster individually, a slow and error-prone process at this scale.
- Undetected configuration drift: Clusters gradually diverged from their intended configuration over time, with no automated way to detect when a cluster fell out of compliance.
- No standard GitOps-native distribution model: Policy changes were not treated as version-controlled, auditable artifacts flowing through the same GitOps pipeline as application deployments.
- Regional teams applying local judgment: Absent a governed baseline, individual regional teams made their own calls on which constraints to apply, producing inconsistent risk exposure.
Ksolves treated this as a governance architecture problem rather than a configuration backlog. Instead of reconciling 15 clusters by hand, the team made policy behave exactly like application code: defined once, version-controlled in a single repository, and delivered to every cluster through the same GitOps pipeline that already ships deployments. The governing principle: one source of truth, continuously reconciled, with divergence treated as a detectable event rather than a discovery made during an audit.
- Centralised Policy Repository: Established a single Git repository holding all Rego policies as the canonical, version-controlled source of truth for the entire fleet.
- GitOps-Synced Policy Distribution: Deployed GitOps controllers on every cluster to automatically pull and apply the latest policy set, eliminating manual per-cluster rollout.
- Fleet-Wide OPA Enforcement: Standardised Open Policy Agent as the admission-time enforcement layer on all 15 clusters, guaranteeing identical policy evaluation regardless of region.
- Automated Drift Detection: Built continuous drift detection that compares live cluster state against the central repository and flags any cluster that has diverged.
- Fleet Compliance Dashboard: Delivered a single aggregated view of policy compliance status across every cluster, replacing the prior cluster-by-cluster manual checking.
Technology Stack
| CATEGORY | TECHNOLOGY |
|---|---|
| DevSecOps | Open Policy Agent (OPA) |
| Integration | GitOps |
| Platform | Kubernetes |
| Infrastructure | Multi-Cluster Management |
| Compliance | Automated Drift Detection |
- All 15 Clusters Brought Into Consistent Compliance Within a Single Quarter: Policy enforcement previously varied cluster by cluster, with some missing critical security constraints entirely; all 15 clusters now run an identical, centrally governed policy set. Policy Rollout Time Cut
- From Per-Cluster to Fleet-Wide: Applying a policy change once meant updating each of the 15 clusters individually; a single Git commit now propagates an update to every cluster automatically via GitOps sync.
- Configuration Drift Now Detected Automatically: Clusters could previously diverge silently from intended policy with no detection mechanism; automated drift detection now flags any of the 15 clusters that falls out of alignment.
- Fleet-Wide Compliance Now Visible in a Single View: Compliance status had to be checked cluster by cluster with no aggregated picture; a single dashboard now reports policy compliance across all 15 clusters at once.
“We used to find out about a policy gap when a cluster failed an audit. Now every cluster runs the same policy from the same source, and we can see the whole fleet’s compliance status at a glance.”
– Head of Platform Engineering
A global enterprise whose 15 GitOps-managed Kubernetes clusters had drifted into 15 different interpretations of policy, with critical security constraints missing in places and no way to see the gap, was brought under unified governance through Ksolves DevOps consulting services. A centralised Rego repository, GitOps-synced distribution to every cluster, fleet-wide OPA enforcement, and continuous drift detection now hold the entire fleet to one auditable policy set. All 15 clusters reached consistent compliance within a single quarter. Policy rollout moved from 15 manual updates to a single commit. Drift is now detected automatically rather than discovered during an audit. Compliance posture across the fleet reads from one dashboard. The distribution model and drift detection layer form a reusable foundation for onboarding additional clusters and regions without re-solving policy consistency each time.
Ready to bring every cluster in your fleet onto one consistently enforced policy set?
