{ "schema": 1, "slug": "platform-engineering", "title": "Platform Engineering", "full_name": "Platform Engineering & Internal Developer Platforms", "category": "Platforms & Cloud", "tagline": "Build internal developer platforms as products: golden paths, self-service APIs and guardrails at scale.", "summary": "Learn to design, build and run an internal developer platform that gives developers self-service golden paths on Kubernetes and the cloud. You will treat the platform as a product, publish infrastructure APIs with Crossplane and kro, deliver through GitOps, expose it via Backstage and MCP, and prove its value with DORA and DevEx metrics.", "description": "Platform engineering is the discipline of building and operating an internal developer platform (IDP): a curated, self-service layer of APIs, templates, automation and guardrails that lets application teams ship to production without becoming experts in Kubernetes, cloud networking or security. The platform team runs this layer as a product, with real users, a roadmap and measurable outcomes, instead of as a ticket queue.\n\nIn 2026 the practice has matured fast. CNCF now certifies platform engineers with the CNPA and the hands-on CNPE, Crossplane has graduated, and DORA research shows that platform quality is what decides whether AI coding assistants actually improve organisational performance. Platforms are increasingly consumed not only through portals but through APIs, CLIs and MCP servers that AI agents call on a developer's behalf, which makes golden paths and policy guardrails more important than ever.\n\nPlatform engineering builds on DevOps culture and GitOps delivery, borrows reliability practices from SRE, embeds DevSecOps controls by default and gives CloudOps and FinOps teams one place to enforce standards. This path takes you from Kubernetes and IaC fundamentals through platform APIs, portals and golden paths to measuring developer experience and running an AI-ready platform.", "icon": "layers", "accent": "#6366F1", "level": "Intermediate → Expert", "duration_weeks": 29, "weekly_hours": 10, "audience": [ "DevOps, cloud and infrastructure engineers who want to move from ticket-driven operations to building self-service products", "SREs and Kubernetes administrators asked to standardise how many teams build, deploy and run services", "Software engineers who enjoy developer tooling, automation and internal APIs", "Engineering managers and architects planning, or rescuing, an internal developer platform initiative" ], "prerequisites": [ "Comfort with Linux, the shell and Git-based pull request workflows", "Hands-on experience deploying an application to at least one public cloud", "Basic container knowledge (building and running images) and YAML", "Ability to read and write code in at least one language such as Python, Go or TypeScript", "Familiarity with CI/CD concepts and a DevOps mindset" ], "outcomes": [ "Define a platform strategy, team charter and thinnest viable platform using platform-as-a-product and Team Topologies principles", "Operate multi-tenant Kubernetes clusters with RBAC, quotas, network policies and admission controls", "Design self-service infrastructure APIs with Crossplane v2, kro or Kratix on top of reusable Terraform or OpenTofu modules", "Deliver applications and platform add-ons through GitOps with Argo CD or Flux across multiple clusters", "Build an internal developer portal in Backstage with a software catalog, TechDocs and golden-path software templates", "Enforce secure-by-default guardrails with Kyverno or OPA and supply chain controls such as SBOMs, signing and SLSA provenance", "Measure platform adoption and impact with DORA metrics, developer experience surveys and platform SLOs", "Expose platform capabilities safely to AI coding agents through MCP servers with scoped permissions and audit trails" ], "trends": [ "CNCF launched the Certified Cloud Native Platform Engineering Associate (CNPA) and, in November 2025, the performance-based Certified Cloud Native Platform Engineer (CNPE), formalising the role.", "Developer portals are becoming AI-native: Backstage ships an MCP actions backend and Port now positions itself as an agentic engineering platform, so coding agents use golden paths behind the same guardrails as humans.", "Crossplane graduated in the CNCF in October 2025, and its v2 release made composite resources namespaced and able to compose any Kubernetes resource, while the Kubernetes SIG project kro offers a lighter way to publish platform APIs.", "DORA's 2025 State of AI-assisted Software Development report found that AI amplifies existing strengths and weaknesses, and that high-quality internal platforms are what turn individual AI gains into organisational performance.", "Platforms are expanding to serve AI workloads, with GPU sharing through Kubernetes Dynamic Resource Allocation, model serving as a platform capability and the CNCF Kubernetes AI Conformance programme launched in November 2025.", "Platform measurement is maturing beyond the four keys: DORA now tracks five delivery metrics including deployment rework rate, combined with DevEx, SPACE and DX Core 4 style developer surveys." ], "roles": [ { "title": "Platform Engineer", "description": "Builds and runs the internal developer platform: Kubernetes clusters, infrastructure APIs, GitOps pipelines, golden-path templates and the guardrails around them. Works in a product team that treats developers as customers." }, { "title": "Platform Architect", "description": "Designs the platform reference architecture, from cluster fleet and tenancy model to platform APIs, identity and policy, and decides what to build, buy or adopt from open source." }, { "title": "Platform Product Manager", "description": "Owns the platform roadmap, runs user research with application teams, prioritises capabilities and tracks adoption, satisfaction and business outcomes." }, { "title": "Developer Experience (DevEx) Engineer", "description": "Focuses on the developer-facing layer of the platform: portals, CLIs, templates, documentation and feedback loops, and measures friction with surveys and delivery data." } ], "stages": [ { "title": "Foundations for Platform Builders", "level": "Beginner", "duration_weeks": 4, "description": "Refresh the engineering basics every platform team relies on: Linux and Git, containers, a systems programming language and the cloud building blocks a platform will abstract.", "milestone": "You can containerise a service, automate repetitive tasks in Go or Python and explain the cloud primitives that your platform will hide behind simpler interfaces.", "topics": [ { "title": "Linux, Git & Automation Basics", "description": "Platform engineers automate everything, so you need fluency with the Linux shell, processes, networking tools and Git workflows. Treat this as a refresher and focus on idempotent scripts and reviewing every change through pull requests.", "est_hours": 10, "optional": false, "concepts": [ "processes & systemd", "permissions & users", "networking tools (dig, curl, ss)", "Bash scripting", "Git branching & pull requests", "trunk-based development" ], "tools": [ "Linux", "Bash", "Git" ], "resources": [ { "title": "The Linux Command Line (free book)", "url": "https://linuxcommand.org/tlcl.php", "type": "book", "free": true }, { "title": "Pro Git (free book)", "url": "https://git-scm.com/book/en/v2", "type": "book", "free": true }, { "title": "Linux Training — DevOpsSchool", "url": "https://www.devopsschool.com/courses/linux/", "type": "course", "free": false } ] }, { "title": "Containers & OCI Images", "description": "Containers are the unit of deployment on almost every platform. Learn how images are built, layered, scanned and run so you can design secure base images and build conventions that every team inherits.", "est_hours": 10, "optional": false, "concepts": [ "OCI images & registries", "multi-stage builds", "minimal and distroless base images", "rootless containers", "tags vs digests", "image provenance" ], "tools": [ "Docker", "Podman" ], "resources": [ { "title": "Docker: Get started", "url": "https://docs.docker.com/get-started/", "type": "docs", "free": true }, { "title": "Podman documentation", "url": "https://podman.io/docs", "type": "docs", "free": true }, { "title": "Docker Training — DevOpsSchool", "url": "https://www.devopsschool.com/courses/docker/", "type": "course", "free": false } ] }, { "title": "Go and Python for Platform Tooling", "description": "Kubernetes, its controllers and most cloud native tools are written in Go, while glue automation is often Python. Learn enough Go to read and extend controllers and CLIs, and enough Python to automate APIs and repetitive platform chores.", "est_hours": 14, "optional": false, "concepts": [ "Go modules, structs & interfaces", "error handling", "calling REST APIs", "building CLIs", "unit testing", "reading Kubernetes client code" ], "tools": [ "Go", "Python" ], "resources": [ { "title": "A Tour of Go", "url": "https://go.dev/tour/", "type": "tutorial", "free": true }, { "title": "The Python Tutorial", "url": "https://docs.python.org/3/tutorial/", "type": "docs", "free": true }, { "title": "Golang Training — DevOpsSchool", "url": "https://www.devopsschool.com/courses/golang/", "type": "course", "free": false } ] }, { "title": "Cloud Fundamentals for Platform Teams", "description": "A platform abstracts cloud primitives, so you must understand them first: accounts and projects, identity, networking, managed Kubernetes and managed data services on at least one hyperscaler.", "est_hours": 8, "optional": false, "concepts": [ "accounts, subscriptions & projects", "IAM & workload identity", "VPC/VNet networking", "managed Kubernetes (EKS, AKS, GKE)", "managed databases & queues", "shared responsibility" ], "tools": [ "AWS", "Microsoft Azure", "Google Cloud" ], "resources": [ { "title": "Overview of Amazon Web Services (whitepaper)", "url": "https://docs.aws.amazon.com/whitepapers/latest/aws-overview/introduction.html", "type": "whitepaper", "free": true }, { "title": "Compare AWS and Azure services to Google Cloud", "url": "https://docs.cloud.google.com/docs/get-started/aws-azure-gcp-service-comparison", "type": "docs", "free": true }, { "title": "Cloud Computing Training — DevOpsSchool", "url": "https://www.devopsschool.com/courses/cloud/", "type": "course", "free": false } ] } ] }, { "title": "Platform Thinking: Platform as a Product", "level": "Beginner", "duration_weeks": 3, "description": "Learn what an internal developer platform is, why organisations build one and how to run it as a product with users, a roadmap and a clear team interaction model.", "milestone": "You can write a platform charter, map developer journeys and argue for a thinnest viable platform using CNCF and Team Topologies vocabulary.", "topics": [ { "title": "Platform Engineering Fundamentals", "description": "Start with a shared vocabulary from the CNCF Platforms White Paper: what a platform is, the capabilities it offers and the attributes of a good one, such as self-service, low cognitive load and secure by default. Learn the difference between a platform, a portal and a platform orchestrator.", "est_hours": 8, "optional": false, "concepts": [ "internal developer platform (IDP)", "platform capabilities", "platform attributes", "portal vs platform vs orchestrator", "shifting down vs shifting left", "cognitive load" ], "tools": [], "resources": [ { "title": "CNCF Platforms White Paper", "url": "https://tag-app-delivery.cncf.io/whitepapers/platforms/", "type": "whitepaper", "free": true }, { "title": "What I Talk About When I Talk About Platforms (martinfowler.com)", "url": "https://martinfowler.com/articles/talk-about-platforms.html", "type": "article", "free": true }, { "title": "What is platform engineering? (PlatformEngineering.org)", "url": "https://platformengineering.org/blog/what-is-platform-engineering", "type": "article", "free": true } ] }, { "title": "Team Topologies & Cognitive Load", "description": "Team Topologies gives platform teams their operating model: stream-aligned teams consume the platform as a service, enabling teams drive adoption and the platform team keeps cognitive load low. The second edition (2025) puts even more weight on intent and cognitive load as design principles.", "est_hours": 8, "optional": false, "concepts": [ "stream-aligned, enabling, complicated-subsystem & platform teams", "collaboration, X-as-a-Service & facilitating modes", "thinnest viable platform", "Conway's law", "team cognitive load", "team APIs" ], "tools": [], "resources": [ { "title": "Team Topologies key concepts", "url": "https://teamtopologies.com/key-concepts", "type": "article", "free": true }, { "title": "Team Topologies, 2nd edition (book)", "url": "https://teamtopologies.com/book", "type": "book", "free": false } ] }, { "title": "Running the Platform as a Product", "description": "Successful platforms are optional, compelling and built incrementally from a minimum viable platform. Learn product discovery with developers, journey mapping, roadmapping, internal marketing and how to decide what not to build.", "est_hours": 8, "optional": false, "concepts": [ "developer interviews & user research", "critical user journeys", "minimum viable platform", "roadmaps & prioritisation", "internal marketing & onboarding", "build vs buy vs adopt" ], "tools": [], "resources": [ { "title": "DORA capability: Platform engineering", "url": "https://dora.dev/capabilities/platform-engineering/", "type": "article", "free": true }, { "title": "Microsoft Platform engineering guide", "url": "https://learn.microsoft.com/en-us/platform-engineering/", "type": "docs", "free": true }, { "title": "How Spotify uses golden paths to solve fragmentation", "url": "https://engineering.atspotify.com/2020/08/how-we-use-golden-paths-to-solve-fragmentation-in-our-software-ecosystem", "type": "article", "free": true } ] }, { "title": "Platform Maturity & Reference Architectures", "description": "Use the CNCF Platform Engineering Maturity Model to assess investment, adoption, interfaces, operations and measurement. Study reference architectures such as CNOE and the Microsoft capabilities model to see how the planes of an IDP fit together.", "est_hours": 6, "optional": false, "concepts": [ "maturity model aspects & levels", "developer control plane", "integration & delivery plane", "resource plane", "security & observability planes", "capability mapping" ], "tools": [], "resources": [ { "title": "CNCF Platform Engineering Maturity Model", "url": "https://tag-app-delivery.cncf.io/whitepapers/platform-eng-maturity-model/", "type": "whitepaper", "free": true }, { "title": "Platform Engineering Capabilities Model (Microsoft)", "url": "https://learn.microsoft.com/en-us/platform-engineering/platform-engineering-capability-model", "type": "docs", "free": true }, { "title": "CNOE: Cloud Native Operational Excellence", "url": "https://cnoe.io/", "type": "docs", "free": true } ] } ] }, { "title": "Kubernetes as the Platform Substrate", "level": "Intermediate", "duration_weeks": 5, "description": "Master Kubernetes as the control plane most platforms are built on, including how to share clusters safely between teams and how to extend the API with your own resources.", "milestone": "You can run a multi-tenant cluster fleet with self-service namespaces and extend Kubernetes with custom resources, controllers and admission policies.", "topics": [ { "title": "Kubernetes Core for Platform Teams", "description": "Go deep on workloads, networking, storage, configuration and cluster operations at CKA and CKAD level, and package applications with Helm and Kustomize. Platform teams must understand Kubernetes well enough to hide it from developers.", "est_hours": 18, "optional": false, "concepts": [ "Pods, Deployments & StatefulSets", "Services, Ingress & Gateway API", "ConfigMaps, Secrets & storage", "Helm charts vs Kustomize overlays", "autoscaling", "cluster upgrades & troubleshooting" ], "tools": [ "Kubernetes", "Helm", "Kustomize" ], "resources": [ { "title": "Kubernetes documentation", "url": "https://kubernetes.io/docs/home/", "type": "docs", "free": true }, { "title": "Helm documentation", "url": "https://helm.sh/docs/", "type": "docs", "free": true }, { "title": "Kubernetes Training — DevOpsSchool", "url": "https://www.devopsschool.com/courses/kubernetes/", "type": "course", "free": false } ] }, { "title": "Multi-Tenancy & Self-Service Namespaces", "description": "Most platforms share clusters between teams. Learn soft and hard multi-tenancy: namespace-as-a-service with RBAC, quotas, network policies and Pod Security Standards, and virtual clusters when teams need more autonomy.", "est_hours": 12, "optional": false, "concepts": [ "namespace-as-a-service", "RBAC & least privilege", "ResourceQuota & LimitRange", "NetworkPolicy", "Pod Security Standards", "virtual clusters" ], "tools": [ "Kubernetes", "vCluster", "Capsule", "Cilium" ], "resources": [ { "title": "Kubernetes multi-tenancy", "url": "https://kubernetes.io/docs/concepts/security/multi-tenancy/", "type": "docs", "free": true }, { "title": "vCluster documentation", "url": "https://www.vcluster.com/docs/vcluster/", "type": "docs", "free": true }, { "title": "Capsule multi-tenancy framework", "url": "https://projectcapsule.dev/", "type": "docs", "free": true } ] }, { "title": "Extending Kubernetes: CRDs, Controllers & Admission", "description": "Platform APIs are usually custom resources reconciled by controllers. Learn the operator pattern, build a small controller with Kubebuilder and validate requests with CEL-based ValidatingAdmissionPolicy.", "est_hours": 12, "optional": false, "concepts": [ "CustomResourceDefinitions", "reconciliation loops", "operator pattern", "status conditions & finalizers", "CEL validation", "ValidatingAdmissionPolicy" ], "tools": [ "Kubernetes", "Go" ], "resources": [ { "title": "Kubernetes custom resources", "url": "https://kubernetes.io/docs/concepts/extend-kubernetes/api-extension/custom-resources/", "type": "docs", "free": true }, { "title": "The Kubebuilder Book", "url": "https://book.kubebuilder.io/", "type": "book", "free": true }, { "title": "Validating Admission Policy", "url": "https://kubernetes.io/docs/reference/access-authn-authz/validating-admission-policy/", "type": "docs", "free": true } ] }, { "title": "Cluster Fleet Lifecycle", "description": "At scale you manage fleets, not clusters. Learn declarative cluster provisioning with Cluster API or managed services, upgrade and version-skew strategies, Gateway API for traffic and how to keep add-ons consistent across the fleet.", "est_hours": 10, "optional": false, "concepts": [ "managed Kubernetes (EKS, AKS, GKE)", "Cluster API", "upgrade strategy & version skew", "fleet-wide add-ons", "Gateway API", "cluster templates" ], "tools": [ "Kubernetes", "Cluster API" ], "resources": [ { "title": "The Cluster API Book", "url": "https://cluster-api.sigs.k8s.io/", "type": "docs", "free": true }, { "title": "Gateway API", "url": "https://gateway-api.sigs.k8s.io/", "type": "docs", "free": true }, { "title": "Certified Kubernetes Administrator (CKA) Training — DevOpsSchool", "url": "https://www.devopsschool.com/certification/certified-kubernetes-administrator-cka.html", "type": "course", "free": false } ] } ] }, { "title": "Infrastructure APIs & Platform Orchestration", "level": "Intermediate", "duration_weeks": 5, "description": "Turn infrastructure into versioned, self-service APIs: reusable IaC modules, Kubernetes-native control planes and workload specifications that hide complexity behind a simple contract.", "milestone": "You can publish a self-service API, such as 'give me a database' or 'give me an environment', that provisions compliant cloud resources on request.", "topics": [ { "title": "Infrastructure as Code as a Product", "description": "Terraform and OpenTofu remain the backbone of cloud provisioning. Learn to design versioned modules, manage remote state, test modules and publish them as products that other teams consume safely.", "est_hours": 14, "optional": false, "concepts": [ "module design & versioning", "remote state & locking", "terraform test", "drift detection", "private module registries", "policy checks on plans" ], "tools": [ "Terraform", "OpenTofu", "Pulumi" ], "resources": [ { "title": "Terraform documentation", "url": "https://developer.hashicorp.com/terraform/docs", "type": "docs", "free": true }, { "title": "OpenTofu documentation", "url": "https://opentofu.org/docs/", "type": "docs", "free": true }, { "title": "Terraform Training — DevOpsSchool", "url": "https://www.devopsschool.com/courses/terraform/", "type": "course", "free": false } ] }, { "title": "Crossplane v2 Control Planes", "description": "Crossplane lets you build your own cloud APIs on Kubernetes. Learn composite resource definitions, compositions built from functions, namespaced managed resources and the v2 Operations type for day-2 workflows.", "est_hours": 14, "optional": false, "concepts": [ "CompositeResourceDefinitions (XRDs)", "compositions & composition functions", "namespaced composite & managed resources", "providers", "Operations for day-2 tasks", "packaging configurations" ], "tools": [ "Crossplane" ], "resources": [ { "title": "What's Crossplane?", "url": "https://docs.crossplane.io/latest/whats-crossplane/", "type": "docs", "free": true }, { "title": "Get started with composition", "url": "https://docs.crossplane.io/latest/get-started/get-started-with-composition/", "type": "tutorial", "free": true }, { "title": "Crossplane Operations", "url": "https://docs.crossplane.io/latest/operations/", "type": "docs", "free": true } ] }, { "title": "Lightweight Platform APIs: kro, Kratix & Score", "description": "Not every platform needs a full control plane. Compare kro ResourceGraphDefinitions, Kratix Promises and the Score workload specification, and learn when each fits your platform's interface strategy.", "est_hours": 12, "optional": false, "concepts": [ "ResourceGraphDefinitions", "CEL wiring between resources", "Kratix Promises", "workload specifications", "platform orchestrators", "API versioning & deprecation" ], "tools": [ "kro", "Kratix", "Score" ], "resources": [ { "title": "kro overview", "url": "https://kro.run/docs/overview/", "type": "docs", "free": true }, { "title": "Kratix documentation", "url": "https://docs.kratix.io/", "type": "docs", "free": true }, { "title": "Score documentation", "url": "https://docs.score.dev/docs/", "type": "docs", "free": true } ] }, { "title": "Secrets, Identity & Platform Access", "description": "A platform must hand out credentials safely. Learn workload identity federation, short-lived and dynamic credentials, Vault and the External Secrets Operator so applications never handle long-lived keys.", "est_hours": 10, "optional": false, "concepts": [ "workload identity", "OIDC federation", "dynamic secrets", "secret synchronisation", "secret rotation", "least-privilege service identities" ], "tools": [ "Vault", "External Secrets Operator" ], "resources": [ { "title": "Vault documentation", "url": "https://developer.hashicorp.com/vault/docs", "type": "docs", "free": true }, { "title": "External Secrets Operator documentation", "url": "https://external-secrets.io/latest/", "type": "docs", "free": true }, { "title": "Vault Training — DevOpsSchool", "url": "https://www.devopsschool.com/courses/vault/", "type": "course", "free": false } ] } ] }, { "title": "GitOps, Delivery & Software Supply Chain", "level": "Advanced", "duration_weeks": 4, "description": "Make Git the source of truth for applications and for the platform itself, and bake build, test, signing and progressive delivery into reusable pipelines.", "milestone": "You can promote a signed application across environments and clusters through GitOps with automated checks and rollbacks.", "topics": [ { "title": "GitOps at Fleet Scale", "description": "Learn the OpenGitOps principles and run Argo CD or Flux to manage both applications and platform add-ons across many clusters, with ApplicationSets, environment promotion and drift detection.", "est_hours": 16, "optional": false, "concepts": [ "OpenGitOps principles", "ApplicationSets & generators", "app-of-apps pattern", "environment promotion", "drift detection & self-heal", "multi-cluster management" ], "tools": [ "Argo CD", "Flux" ], "resources": [ { "title": "Argo CD documentation", "url": "https://argo-cd.readthedocs.io/en/stable/", "type": "docs", "free": true }, { "title": "Flux documentation", "url": "https://fluxcd.io/flux/", "type": "docs", "free": true }, { "title": "GitOps Training — DevOpsSchool", "url": "https://www.devopsschool.com/courses/gitops/", "type": "course", "free": false } ] }, { "title": "Reusable CI & Supply Chain Security", "description": "Golden paths include the pipeline. Build reusable CI workflows that generate SBOMs, scan images, sign artifacts with Sigstore and record SLSA provenance, so every team gets supply chain security by default.", "est_hours": 14, "optional": false, "concepts": [ "reusable workflows & templates", "SBOMs (SPDX, CycloneDX)", "image and dependency scanning", "keyless signing", "SLSA provenance", "OIDC from CI to cloud" ], "tools": [ "GitHub Actions", "GitLab CI/CD", "Trivy", "Sigstore" ], "resources": [ { "title": "GitHub Actions: Reuse workflows", "url": "https://docs.github.com/en/actions/how-tos/reuse-automations/reuse-workflows", "type": "docs", "free": true }, { "title": "SLSA specification", "url": "https://slsa.dev/spec/v1.1/", "type": "docs", "free": true }, { "title": "Sigstore documentation", "url": "https://docs.sigstore.dev/", "type": "docs", "free": true } ] }, { "title": "Progressive Delivery & Feature Flags", "description": "Offer safer releases as a platform capability with canary and blue-green rollouts, automated metric analysis and vendor-neutral feature flags.", "est_hours": 8, "optional": true, "concepts": [ "canary & blue-green", "automated analysis", "automatic rollback", "feature flags", "OpenFeature providers" ], "tools": [ "Argo Rollouts", "OpenFeature" ], "resources": [ { "title": "Argo Rollouts", "url": "https://argoproj.github.io/rollouts/", "type": "docs", "free": true }, { "title": "OpenFeature documentation", "url": "https://openfeature.dev/docs/reference/intro/", "type": "docs", "free": true } ] } ] }, { "title": "Developer Portals, Golden Paths & Guardrails", "level": "Advanced", "duration_weeks": 4, "description": "Give developers a front door to the platform with a portal, opinionated golden-path templates and policy guardrails that make the right way the easy way.", "milestone": "You can scaffold a production-ready service from a portal template that is catalogued, documented, secured and deployed automatically.", "topics": [ { "title": "Backstage Developer Portal", "description": "Backstage is the CNCF project most organisations use for internal developer portals. Learn the software catalog and entity model, TechDocs, the Kubernetes plugin and the new backend and frontend systems for building plugins.", "est_hours": 14, "optional": false, "concepts": [ "software catalog & entity descriptors", "ownership & system modelling", "TechDocs (docs-like-code)", "plugins & the new backend system", "authentication & permissions", "scorecards" ], "tools": [ "Backstage" ], "resources": [ { "title": "What is Backstage?", "url": "https://backstage.io/docs/overview/what-is-backstage", "type": "docs", "free": true }, { "title": "Backstage Software Catalog", "url": "https://backstage.io/docs/features/software-catalog/", "type": "docs", "free": true }, { "title": "Backstage backend system", "url": "https://backstage.io/docs/backend-system/", "type": "docs", "free": true } ] }, { "title": "Golden Paths & Software Templates", "description": "Golden paths are opinionated, supported routes to production. Build Backstage software templates that scaffold repositories, CI, infrastructure requests and catalog entries, and maintain them as products with versions and day-2 updates.", "est_hours": 12, "optional": false, "concepts": [ "golden paths vs paved roads", "software templates & scaffolder actions", "template versioning", "day-2 updates to scaffolded repos", "documentation as onboarding", "escape hatches" ], "tools": [ "Backstage", "GitHub Actions" ], "resources": [ { "title": "Backstage Software Templates", "url": "https://backstage.io/docs/features/software-templates/", "type": "docs", "free": true }, { "title": "Backstage TechDocs", "url": "https://backstage.io/docs/features/techdocs/", "type": "docs", "free": true } ] }, { "title": "Portal Alternatives & Build vs Buy", "description": "Compare self-hosted Backstage with SaaS portals such as Port and Spotify Portal for Backstage. Evaluate total cost of ownership, extensibility, data model and AI features before committing.", "est_hours": 5, "optional": true, "concepts": [ "self-hosted vs SaaS portals", "blueprints & data models", "scorecards & initiatives", "total cost of ownership", "lock-in & exit strategy" ], "tools": [ "Port", "Backstage" ], "resources": [ { "title": "Port documentation", "url": "https://docs.port.io/", "type": "docs", "free": true }, { "title": "Spotify Portal for Backstage documentation", "url": "https://backstage.spotify.com/docs/portal/", "type": "docs", "free": true } ] }, { "title": "Policy as Code & Guardrails", "description": "Guardrails keep self-service safe. Write admission and audit policies with Kyverno or OPA Gatekeeper, shift the same checks into CI and manage exceptions transparently instead of blocking developers.", "est_hours": 10, "optional": false, "concepts": [ "admission control", "validate, mutate & generate policies", "Rego basics", "policy exceptions", "audit vs enforce", "policy reports" ], "tools": [ "Kyverno", "OPA" ], "resources": [ { "title": "Kyverno documentation", "url": "https://kyverno.io/docs/introduction/", "type": "docs", "free": true }, { "title": "OPA Gatekeeper documentation", "url": "https://open-policy-agent.github.io/gatekeeper/website/docs/", "type": "docs", "free": true }, { "title": "Open Policy Agent Training — DevOpsSchool", "url": "https://www.devopsschool.com/courses/opa/", "type": "course", "free": false } ] } ] }, { "title": "Operating, Measuring & AI-Enabling the Platform", "level": "Expert", "duration_weeks": 4, "description": "Run the platform like a production product: observe it, set SLOs, prove its value with delivery and developer experience metrics, make costs visible and open it safely to AI agents.", "milestone": "You can report platform health, adoption and impact to leadership and let AI coding agents use platform capabilities within the same guardrails as humans.", "topics": [ { "title": "Platform Observability & SLOs", "description": "Platform services such as CI runners, GitOps controllers and the portal need their own SLOs. Offer OpenTelemetry-based observability as a self-service capability and monitor the platform itself with Prometheus and Grafana.", "est_hours": 12, "optional": false, "concepts": [ "OpenTelemetry SDKs & Collector", "golden signals", "platform SLOs & error budgets", "observability as a self-service capability", "alerting on SLOs", "telemetry pipelines" ], "tools": [ "OpenTelemetry", "Prometheus", "Grafana" ], "resources": [ { "title": "OpenTelemetry documentation", "url": "https://opentelemetry.io/docs/", "type": "docs", "free": true }, { "title": "Implementing SLOs (Google SRE Workbook)", "url": "https://sre.google/workbook/implementing-slos/", "type": "book", "free": true }, { "title": "OpenTelemetry Training — DevOpsSchool", "url": "https://www.devopsschool.com/courses/opentelemetry/", "type": "course", "free": false } ] }, { "title": "Measuring Developer Experience & Platform Value", "description": "Combine DORA's five software delivery metrics with developer experience research (SPACE, DevEx, DX Core 4), adoption data and satisfaction surveys to prove the platform's impact and steer the roadmap.", "est_hours": 8, "optional": false, "concepts": [ "DORA metrics incl. deployment rework rate", "SPACE framework", "DevEx: feedback loops, cognitive load, flow", "DX Core 4", "adoption, CSAT & NPS", "avoiding vanity metrics" ], "tools": [], "resources": [ { "title": "DORA's software delivery performance metrics", "url": "https://dora.dev/guides/dora-metrics/", "type": "article", "free": true }, { "title": "The SPACE of Developer Productivity (paper)", "url": "https://www.microsoft.com/en-us/research/publication/the-space-of-developer-productivity-theres-more-to-it-than-you-think/", "type": "report", "free": true }, { "title": "DevEx: What Actually Drives Productivity (paper)", "url": "https://getdx.com/research/devex-what-actually-drives-productivity/", "type": "report", "free": true } ] }, { "title": "Cost Visibility & Showback", "description": "Make cost a first-class platform signal: allocate Kubernetes and cloud spend to teams, surface it in the portal and ship efficient defaults in templates.", "est_hours": 6, "optional": true, "concepts": [ "cost allocation by namespace & label", "showback vs chargeback", "rightsizing defaults", "FinOps collaboration", "unit economics" ], "tools": [ "OpenCost" ], "resources": [ { "title": "OpenCost documentation", "url": "https://opencost.io/docs/", "type": "docs", "free": true }, { "title": "FinOps Framework", "url": "https://www.finops.org/framework/", "type": "article", "free": true }, { "title": "FinOps Training — DevOpsSchool", "url": "https://www.devopsschool.com/courses/finops/", "type": "course", "free": false } ] }, { "title": "AI-Native Platforms & MCP", "description": "AI agents are becoming platform users. Expose catalog queries, templates and self-service actions through MCP servers such as Backstage's MCP actions backend, give agents scoped identities and audit trails, and prepare the platform to serve GPU and model-serving workloads.", "est_hours": 14, "optional": false, "concepts": [ "Model Context Protocol (MCP) servers", "AI-assisted golden paths", "agent and non-human identity", "approvals, guardrails & audit for agents", "GPU sharing with Dynamic Resource Allocation", "Kubernetes AI Conformance" ], "tools": [ "Model Context Protocol", "Backstage", "Kubernetes" ], "resources": [ { "title": "Backstage MCP Actions Backend", "url": "https://backstage.io/docs/ai/mcp-actions", "type": "docs", "free": true }, { "title": "Model Context Protocol documentation", "url": "https://modelcontextprotocol.io/", "type": "docs", "free": true }, { "title": "DORA AI Capabilities Model", "url": "https://dora.dev/ai/capabilities-model/report/", "type": "report", "free": true } ] } ] } ], "projects": [ { "title": "Platform Charter & Developer Journey Map", "description": "Interview at least five developers, map the path-to-production journey and its pain points, and publish a one-page platform charter with personas, a thinnest viable platform scope and the success metrics you will track.", "difficulty": "Beginner", "skills": [ "product discovery", "Team Topologies", "journey mapping", "metrics design" ] }, { "title": "Self-Service Namespace Vending", "description": "Build a Git-driven workflow where a team requests a namespace through a pull request and receives RBAC, quotas, network policies and Kyverno guardrails, reconciled by Argo CD ApplicationSets across two clusters.", "difficulty": "Intermediate", "skills": [ "Kubernetes multi-tenancy", "Argo CD", "Kyverno", "RBAC" ] }, { "title": "Database-as-a-Service Platform API", "description": "Publish a namespaced PostgreSQL API with Crossplane v2 or kro that provisions a managed cloud database, network access and credentials delivered by the External Secrets Operator, with size tiers and secure defaults.", "difficulty": "Intermediate", "skills": [ "Crossplane", "kro", "API design", "External Secrets Operator" ] }, { "title": "Backstage Golden Path End to End", "description": "Create a Backstage software template that scaffolds a service repository with reusable CI (SBOM, Trivy scan, Sigstore signing), registers it in the catalog with TechDocs and deploys it through GitOps to a dev environment in minutes.", "difficulty": "Advanced", "skills": [ "Backstage", "GitHub Actions", "Sigstore", "Argo CD", "golden paths" ] }, { "title": "Platform Scorecard & DevEx Dashboard", "description": "Instrument the platform with OpenTelemetry, define SLOs for CI and GitOps services, compute DORA's five metrics for onboarded teams and combine them with a quarterly developer survey in a Grafana dashboard for leadership.", "difficulty": "Advanced", "skills": [ "OpenTelemetry", "Grafana", "DORA metrics", "SLOs", "developer surveys" ] }, { "title": "MCP-Enabled Platform Assistant", "description": "Expose catalog search, template execution and environment requests to an AI coding agent through Backstage's MCP actions backend or a custom MCP server, with scoped tokens, policy checks, human approval for write actions and a complete audit log.", "difficulty": "Advanced", "skills": [ "Model Context Protocol", "Backstage", "policy as code", "agent identity", "audit logging" ] } ], "certifications": [ { "name": "Certified Cloud Native Platform Engineering Associate (CNPA)", "provider": "CNCF / Linux Foundation", "url": "https://training.linuxfoundation.org/certification/certified-cloud-native-platform-engineering-associate-cnpa/", "level": "Associate", "note": "Entry-level exam on platform fundamentals, IDPs, GitOps, platform APIs and measurement; the natural first credential for this path." }, { "name": "Certified Cloud Native Platform Engineer (CNPE)", "provider": "CNCF / Linux Foundation", "url": "https://training.linuxfoundation.org/certification/certified-cloud-native-platform-engineer-cnpe/", "level": "Professional", "note": "Hands-on, performance-based exam launched in November 2025 covering platform architecture, GitOps, platform APIs, observability and policy; the capstone certification for this path." }, { "name": "Certified Kubernetes Administrator (CKA)", "provider": "CNCF / Linux Foundation", "url": "https://training.linuxfoundation.org/certification/certified-kubernetes-administrator-cka/", "level": "Professional", "note": "Proves you can install, operate and troubleshoot the Kubernetes clusters most internal platforms are built on." }, { "name": "Certified Kubernetes Application Developer (CKAD)", "provider": "CNCF / Linux Foundation", "url": "https://training.linuxfoundation.org/certification/certified-kubernetes-application-developer-ckad/", "level": "Professional", "note": "Validates the developer-side Kubernetes skills you need to design golden paths that application teams actually want to use." }, { "name": "Certified Backstage Associate (CBA)", "provider": "CNCF / Linux Foundation", "url": "https://training.linuxfoundation.org/certification/certified-backstage-associate-cba/", "level": "Associate", "note": "Covers the Backstage catalog, infrastructure, development workflow and customisation for teams running a Backstage developer portal." }, { "name": "HashiCorp Certified: Terraform Associate (004)", "provider": "HashiCorp", "url": "https://developer.hashicorp.com/certifications/terraform-associate", "level": "Associate", "note": "Validates the module and state skills behind most platform infrastructure APIs; the current 004 exam tests Terraform 1.12." } ], "tools_catalog": [ { "name": "Argo CD", "category": "GitOps", "website": "https://argo-cd.readthedocs.io/", "ds_course_url": "https://www.devopsschool.com/courses/argo/" }, { "name": "Argo Rollouts", "category": "CI/CD & Release", "website": "https://argoproj.github.io/rollouts/", "ds_course_url": "https://www.devopsschool.com/courses/argo/" }, { "name": "AWS", "category": "Cloud Platforms & Governance", "website": "https://aws.amazon.com/", "ds_course_url": "https://www.devopsschool.com/courses/aws/" }, { "name": "Backstage", "category": "Platform Engineering", "website": "https://backstage.io/", "ds_course_url": "" }, { "name": "Bash", "category": "Foundations & Languages", "website": "https://www.gnu.org/software/bash/", "ds_course_url": "https://www.devopsschool.com/courses/bashscripting/" }, { "name": "Capsule", "category": "Containers & Kubernetes", "website": "https://projectcapsule.dev/", "ds_course_url": "" }, { "name": "Cilium", "category": "Networking & Network Automation", "website": "https://cilium.io/", "ds_course_url": "" }, { "name": "Cluster API", "category": "Containers & Kubernetes", "website": "https://cluster-api.sigs.k8s.io/", "ds_course_url": "" }, { "name": "Crossplane", "category": "Infrastructure as Code & Automation", "website": "https://www.crossplane.io/", "ds_course_url": "" }, { "name": "Docker", "category": "Containers & Kubernetes", "website": "https://www.docker.com/", "ds_course_url": "https://www.devopsschool.com/courses/docker/" }, { "name": "External Secrets Operator", "category": "Policy as Code & Secrets", "website": "https://external-secrets.io/", "ds_course_url": "" }, { "name": "Flux", "category": "GitOps", "website": "https://fluxcd.io/", "ds_course_url": "https://www.devopsschool.com/courses/flux/" }, { "name": "Git", "category": "Foundations & Languages", "website": "https://git-scm.com/", "ds_course_url": "https://www.devopsschool.com/courses/git/" }, { "name": "GitHub Actions", "category": "CI/CD & Release", "website": "https://github.com/features/actions", "ds_course_url": "https://www.devopsschool.com/courses/github/" }, { "name": "GitLab CI/CD", "category": "CI/CD & Release", "website": "https://docs.gitlab.com/ci/", "ds_course_url": "https://www.devopsschool.com/courses/gitlab/" }, { "name": "Go", "category": "Foundations & Languages", "website": "https://go.dev/", "ds_course_url": "https://www.devopsschool.com/courses/golang/" }, { "name": "Google Cloud", "category": "Cloud Platforms & Governance", "website": "https://cloud.google.com/", "ds_course_url": "https://www.devopsschool.com/courses/googlecloud/" }, { "name": "Grafana", "category": "Observability", "website": "https://grafana.com/", "ds_course_url": "https://www.devopsschool.com/courses/grafana/" }, { "name": "Helm", "category": "Containers & Kubernetes", "website": "https://helm.sh/", "ds_course_url": "https://www.devopsschool.com/courses/kubernetes/" }, { "name": "Kratix", "category": "Platform Engineering", "website": "https://www.kratix.io/", "ds_course_url": "" }, { "name": "kro", "category": "Platform Engineering", "website": "https://kro.run/", "ds_course_url": "" }, { "name": "Kubernetes", "category": "Containers & Kubernetes", "website": "https://kubernetes.io/", "ds_course_url": "https://www.devopsschool.com/courses/kubernetes/" }, { "name": "Kustomize", "category": "Containers & Kubernetes", "website": "https://kustomize.io/", "ds_course_url": "" }, { "name": "Kyverno", "category": "Policy as Code & Secrets", "website": "https://kyverno.io/", "ds_course_url": "" }, { "name": "Linux", "category": "Foundations & Languages", "website": "https://www.kernel.org/", "ds_course_url": "https://www.devopsschool.com/courses/linux/" }, { "name": "Microsoft Azure", "category": "Cloud Platforms & Governance", "website": "https://azure.microsoft.com/", "ds_course_url": "https://www.devopsschool.com/courses/azure/" }, { "name": "Model Context Protocol", "category": "LLMs, Agents & GenAI", "website": "https://modelcontextprotocol.io/", "ds_course_url": "" }, { "name": "OPA", "category": "Policy as Code & Secrets", "website": "https://www.openpolicyagent.org/", "ds_course_url": "https://www.devopsschool.com/courses/opa/" }, { "name": "OpenCost", "category": "FinOps & Sustainability", "website": "https://opencost.io/", "ds_course_url": "https://www.devopsschool.com/courses/finops/" }, { "name": "OpenFeature", "category": "CI/CD & Release", "website": "https://openfeature.dev/", "ds_course_url": "" }, { "name": "OpenTelemetry", "category": "Observability", "website": "https://opentelemetry.io/", "ds_course_url": "https://www.devopsschool.com/courses/opentelemetry/" }, { "name": "OpenTofu", "category": "Infrastructure as Code & Automation", "website": "https://opentofu.org/", "ds_course_url": "https://www.devopsschool.com/courses/opentofu/" }, { "name": "Podman", "category": "Containers & Kubernetes", "website": "https://podman.io/", "ds_course_url": "https://www.devopsschool.com/courses/podman/" }, { "name": "Port", "category": "Platform Engineering", "website": "https://www.port.io/", "ds_course_url": "" }, { "name": "Prometheus", "category": "Observability", "website": "https://prometheus.io/", "ds_course_url": "https://www.devopsschool.com/courses/prometheus/" }, { "name": "Pulumi", "category": "Infrastructure as Code & Automation", "website": "https://www.pulumi.com/", "ds_course_url": "" }, { "name": "Python", "category": "Foundations & Languages", "website": "https://www.python.org/", "ds_course_url": "https://www.devopsschool.com/courses/python/" }, { "name": "Score", "category": "Platform Engineering", "website": "https://score.dev/", "ds_course_url": "" }, { "name": "Sigstore", "category": "Security & Supply Chain", "website": "https://www.sigstore.dev/", "ds_course_url": "" }, { "name": "Terraform", "category": "Infrastructure as Code & Automation", "website": "https://developer.hashicorp.com/terraform", "ds_course_url": "https://www.devopsschool.com/courses/terraform/" }, { "name": "Trivy", "category": "Security & Supply Chain", "website": "https://trivy.dev/", "ds_course_url": "" }, { "name": "Vault", "category": "Policy as Code & Secrets", "website": "https://developer.hashicorp.com/vault", "ds_course_url": "https://www.devopsschool.com/courses/vault/" }, { "name": "vCluster", "category": "Containers & Kubernetes", "website": "https://www.vcluster.com/", "ds_course_url": "" } ], "faqs": [ { "q": "What is the difference between platform engineering and DevOps?", "a": "DevOps is a culture and set of practices for fast, reliable delivery through collaboration and automation. Platform engineering is a way to scale DevOps: a dedicated team builds a self-service internal developer platform so application teams get pipelines, infrastructure and guardrails without each team reinventing them. The goal is to reduce cognitive load rather than ask every developer to master the whole stack." }, { "q": "Do I need Backstage to build an internal developer platform?", "a": "No. A portal is only the front door; the platform is the APIs, automation and guardrails behind it. Many successful platforms start with Git repositories, templates and a CLI, then add Backstage or a SaaS portal such as Port when discoverability and a software catalog become the bottleneck." }, { "q": "Should I take the CNPA, CNPE or CKA first?", "a": "If you are new to the field, take the CNPA for the vocabulary and concepts, then the CKA or CKAD to prove hands-on Kubernetes skills. The CNPE is a performance-based exam that assumes you can already work with GitOps, platform APIs, observability and policy on Kubernetes, so it fits near the end of this path." }, { "q": "How long does it take to become a platform engineer?", "a": "With a DevOps or cloud background and about 10 hours a week, this path takes around seven months. Engineers coming from application development usually need extra time on Kubernetes and cloud networking, while experienced Kubernetes administrators can move faster through the early stages." }, { "q": "Which programming language should a platform engineer learn?", "a": "Go is the language of Kubernetes, controllers, Crossplane functions and most cloud native tools, so it is the most valuable to learn. Python is excellent for automation and glue code, and TypeScript helps if you will build Backstage plugins." }, { "q": "How do you measure whether an internal developer platform is working?", "a": "Track voluntary adoption of golden paths, DORA delivery metrics for onboarded teams, developer satisfaction and friction from regular surveys, and platform SLOs such as pipeline and provisioning reliability. Combine quantitative and qualitative data, as the CNCF maturity model recommends, and avoid vanity metrics such as the number of templates." }, { "q": "How is AI changing platform engineering?", "a": "AI coding agents are becoming platform users, so platforms now expose capabilities through MCP servers and APIs as well as portals. DORA's 2025 research found that high-quality platforms are what turn AI gains into organisational performance, which makes golden paths, policy guardrails, agent identity and audit more important, not less." } ], "related": [ "devops", "gitops", "sre", "devsecops" ], "key_tools": [ "Backstage", "Kubernetes", "Crossplane", "Argo CD", "Terraform", "Kratix" ], "course_url": "", "seo_title": "Platform Engineering Learning Path 2026: Roadmap & Tools", "seo_description": "Become a platform engineer in 2026: platform as a product, Kubernetes, Crossplane, GitOps, Backstage golden paths, DevEx metrics, MCP and CNPE prep.", "url": "https://www.devopsschool.com/path/platform-engineering/", "updated_at": "2026-10-26 08:58:45" }