Every regulated org has the same scar: a beautiful governance tool - a CMDB, a compliance tracker, a project portal - that describes what production should look like, sitting next to a real platform that actually runs something else. Two sources of truth. Manual sync. Tickets. Drift. The compliance team trusts the tool; the SREs trust the cluster; nobody trusts the gap between them. This talk is a field report on closing that gap. Drawing on a teardown of a large enterprise platform and the sovereign platform we're building at SPITZKOP, I'll show how to make the control plane connected to the execution plane: GitOps as the single source of truth, policy-ascode (Kyverno) as the admission backstop, schema-first config generation (CUE) shifting compliance left, and a conformity engine that turns regulatory requirements (NIS2, DORA, EUCS) into executable, attested deployment steps — not Excel rows. You'll leave with a concrete pattern for making compliance a property of your pipeline, not a parallel universe.
Eugène Ngontang is Founder & CTO of SPITZKOP, where he's building ESSINGAN — a sovereign platform-engineering product for regulated and critical workloads. He's spent years operating production-critical infrastructure for large enterprises (PwC, NCR Atleos and others), with a focus on GitOps, platform engineering, confidential computing, and measurable sovereignty. He previously presented sovereign network automation (GitOps + YANG) at FRnOG-42. He works at the intersection of reliability, compliance, and cloud-native engineering.
