Build internal developer platforms as products: golden paths, self-service APIs and guardrails at scale.
Learn to design, build and run an internal developer platform that gives developers self-service golden paths on Kubernetes and the cloud. You will treat the platform as a product, publish infrastructure APIs with Crossplane and kro, deliver through GitOps, expose it via Backstage and MCP, and prove its value with DORA and DevEx metrics.
Platform engineering is the discipline of building and operating an internal developer platform (IDP): a curated, self-service layer of APIs, templates, automation and guardrails that lets application teams ship to production without becoming experts in Kubernetes, cloud networking or security. The platform team runs this layer as a product, with real users, a roadmap and measurable outcomes, instead of as a ticket queue.
In 2026 the practice has matured fast. CNCF now certifies platform engineers with the CNPA and the hands-on CNPE, Crossplane has graduated, and DORA research shows that platform quality is what decides whether AI coding assistants actually improve organisational performance. Platforms are increasingly consumed not only through portals but through APIs, CLIs and MCP servers that AI agents call on a developer's behalf, which makes golden paths and policy guardrails more important than ever.
Platform engineering builds on DevOps culture and GitOps delivery, borrows reliability practices from SRE, embeds DevSecOps controls by default and gives CloudOps and FinOps teams one place to enforce standards. This path takes you from Kubernetes and IaC fundamentals through platform APIs, portals and golden paths to measuring developer experience and running an AI-ready platform.
7 stages · 27 topics · ~293 hours of focused learning. Work through the stages in order; optional topics are electives you can come back to.
Refresh the engineering basics every platform team relies on: Linux and Git, containers, a systems programming language and the cloud building blocks a platform will abstract.
Platform engineers automate everything, so you need fluency with the Linux shell, processes, networking tools and Git workflows. Treat this as a refresher and focus on idempotent scripts and reviewing every change through pull requests.
Containers are the unit of deployment on almost every platform. Learn how images are built, layered, scanned and run so you can design secure base images and build conventions that every team inherits.
Kubernetes, its controllers and most cloud native tools are written in Go, while glue automation is often Python. Learn enough Go to read and extend controllers and CLIs, and enough Python to automate APIs and repetitive platform chores.
A platform abstracts cloud primitives, so you must understand them first: accounts and projects, identity, networking, managed Kubernetes and managed data services on at least one hyperscaler.
Milestone: You can containerise a service, automate repetitive tasks in Go or Python and explain the cloud primitives that your platform will hide behind simpler interfaces.
Learn what an internal developer platform is, why organisations build one and how to run it as a product with users, a roadmap and a clear team interaction model.
Start with a shared vocabulary from the CNCF Platforms White Paper: what a platform is, the capabilities it offers and the attributes of a good one, such as self-service, low cognitive load and secure by default. Learn the difference between a platform, a portal and a platform orchestrator.
Team Topologies gives platform teams their operating model: stream-aligned teams consume the platform as a service, enabling teams drive adoption and the platform team keeps cognitive load low. The second edition (2025) puts even more weight on intent and cognitive load as design principles.
Successful platforms are optional, compelling and built incrementally from a minimum viable platform. Learn product discovery with developers, journey mapping, roadmapping, internal marketing and how to decide what not to build.
Use the CNCF Platform Engineering Maturity Model to assess investment, adoption, interfaces, operations and measurement. Study reference architectures such as CNOE and the Microsoft capabilities model to see how the planes of an IDP fit together.
Milestone: You can write a platform charter, map developer journeys and argue for a thinnest viable platform using CNCF and Team Topologies vocabulary.
Master Kubernetes as the control plane most platforms are built on, including how to share clusters safely between teams and how to extend the API with your own resources.
Go deep on workloads, networking, storage, configuration and cluster operations at CKA and CKAD level, and package applications with Helm and Kustomize. Platform teams must understand Kubernetes well enough to hide it from developers.
Most platforms share clusters between teams. Learn soft and hard multi-tenancy: namespace-as-a-service with RBAC, quotas, network policies and Pod Security Standards, and virtual clusters when teams need more autonomy.
Platform APIs are usually custom resources reconciled by controllers. Learn the operator pattern, build a small controller with Kubebuilder and validate requests with CEL-based ValidatingAdmissionPolicy.
At scale you manage fleets, not clusters. Learn declarative cluster provisioning with Cluster API or managed services, upgrade and version-skew strategies, Gateway API for traffic and how to keep add-ons consistent across the fleet.
Milestone: You can run a multi-tenant cluster fleet with self-service namespaces and extend Kubernetes with custom resources, controllers and admission policies.
Turn infrastructure into versioned, self-service APIs: reusable IaC modules, Kubernetes-native control planes and workload specifications that hide complexity behind a simple contract.
Terraform and OpenTofu remain the backbone of cloud provisioning. Learn to design versioned modules, manage remote state, test modules and publish them as products that other teams consume safely.
Crossplane lets you build your own cloud APIs on Kubernetes. Learn composite resource definitions, compositions built from functions, namespaced managed resources and the v2 Operations type for day-2 workflows.
Not every platform needs a full control plane. Compare kro ResourceGraphDefinitions, Kratix Promises and the Score workload specification, and learn when each fits your platform's interface strategy.
A platform must hand out credentials safely. Learn workload identity federation, short-lived and dynamic credentials, Vault and the External Secrets Operator so applications never handle long-lived keys.
Milestone: You can publish a self-service API, such as 'give me a database' or 'give me an environment', that provisions compliant cloud resources on request.
Make Git the source of truth for applications and for the platform itself, and bake build, test, signing and progressive delivery into reusable pipelines.
Learn the OpenGitOps principles and run Argo CD or Flux to manage both applications and platform add-ons across many clusters, with ApplicationSets, environment promotion and drift detection.
Golden paths include the pipeline. Build reusable CI workflows that generate SBOMs, scan images, sign artifacts with Sigstore and record SLSA provenance, so every team gets supply chain security by default.
Offer safer releases as a platform capability with canary and blue-green rollouts, automated metric analysis and vendor-neutral feature flags.
Milestone: You can promote a signed application across environments and clusters through GitOps with automated checks and rollbacks.
Give developers a front door to the platform with a portal, opinionated golden-path templates and policy guardrails that make the right way the easy way.
Backstage is the CNCF project most organisations use for internal developer portals. Learn the software catalog and entity model, TechDocs, the Kubernetes plugin and the new backend and frontend systems for building plugins.
Golden paths are opinionated, supported routes to production. Build Backstage software templates that scaffold repositories, CI, infrastructure requests and catalog entries, and maintain them as products with versions and day-2 updates.
Compare self-hosted Backstage with SaaS portals such as Port and Spotify Portal for Backstage. Evaluate total cost of ownership, extensibility, data model and AI features before committing.
Guardrails keep self-service safe. Write admission and audit policies with Kyverno or OPA Gatekeeper, shift the same checks into CI and manage exceptions transparently instead of blocking developers.
Milestone: You can scaffold a production-ready service from a portal template that is catalogued, documented, secured and deployed automatically.
Run the platform like a production product: observe it, set SLOs, prove its value with delivery and developer experience metrics, make costs visible and open it safely to AI agents.
Platform services such as CI runners, GitOps controllers and the portal need their own SLOs. Offer OpenTelemetry-based observability as a self-service capability and monitor the platform itself with Prometheus and Grafana.
Combine DORA's five software delivery metrics with developer experience research (SPACE, DevEx, DX Core 4), adoption data and satisfaction surveys to prove the platform's impact and steer the roadmap.
Make cost a first-class platform signal: allocate Kubernetes and cloud spend to teams, surface it in the portal and ship efficient defaults in templates.
AI agents are becoming platform users. Expose catalog queries, templates and self-service actions through MCP servers such as Backstage's MCP actions backend, give agents scoped identities and audit trails, and prepare the platform to serve GPU and model-serving workloads.
Milestone: You can report platform health, adoption and impact to leadership and let AI coding agents use platform capabilities within the same guardrails as humans.
43 tools and platforms used across this path. Focus on concepts first — tools change, principles don’t.
Build these to prove your skills. Publish each one on GitHub with a clear README and architecture diagram.
Interview at least five developers, map the path-to-production journey and its pain points, and publish a one-page platform charter with personas, a thinnest viable platform scope and the success metrics you will track.
Build a Git-driven workflow where a team requests a namespace through a pull request and receives RBAC, quotas, network policies and Kyverno guardrails, reconciled by Argo CD ApplicationSets across two clusters.
Publish a namespaced PostgreSQL API with Crossplane v2 or kro that provisions a managed cloud database, network access and credentials delivered by the External Secrets Operator, with size tiers and secure defaults.
Create a Backstage software template that scaffolds a service repository with reusable CI (SBOM, Trivy scan, Sigstore signing), registers it in the catalog with TechDocs and deploys it through GitOps to a dev environment in minutes.
Instrument the platform with OpenTelemetry, define SLOs for CI and GitOps services, compute DORA's five metrics for onboarded teams and combine them with a quarterly developer survey in a Grafana dashboard for leadership.
Expose catalog search, template execution and environment requests to an AI coding agent through Backstage's MCP actions backend or a custom MCP server, with scoped tokens, policy checks, human approval for write actions and a complete audit log.
Certifications that validate this path’s skills. Always confirm the current exam version on the official page before booking.
CNCF / Linux Foundation
Entry-level exam on platform fundamentals, IDPs, GitOps, platform APIs and measurement; the natural first credential for this path.
Official pageCNCF / Linux Foundation
Hands-on, performance-based exam launched in November 2025 covering platform architecture, GitOps, platform APIs, observability and policy; the capstone certification for this path.
Official pageCNCF / Linux Foundation
Proves you can install, operate and troubleshoot the Kubernetes clusters most internal platforms are built on.
Official pageCNCF / Linux Foundation
Validates the developer-side Kubernetes skills you need to design golden paths that application teams actually want to use.
Official pageCNCF / Linux Foundation
Covers the Backstage catalog, infrastructure, development workflow and customisation for teams running a Backstage developer portal.
Official pageHashiCorp
Validates the module and state skills behind most platform infrastructure APIs; the current 004 exam tests Terraform 1.12.
Official pageRoles that hire for these skills.
Builds and runs the internal developer platform: Kubernetes clusters, infrastructure APIs, GitOps pipelines, golden-path templates and the guardrails around them. Works in a product team that treats developers as customers.
Designs the platform reference architecture, from cluster fleet and tenancy model to platform APIs, identity and policy, and decides what to build, buy or adopt from open source.
Owns the platform roadmap, runs user research with application teams, prioritises capabilities and tracks adoption, satisfaction and business outcomes.
Focuses on the developer-facing layer of the platform: portals, CLIs, templates, documentation and feedback loops, and measures friction with surveys and delivery data.
DevOps is a culture and set of practices for fast, reliable delivery through collaboration and automation. Platform engineering is a way to scale DevOps: a dedicated team builds a self-service internal developer platform so application teams get pipelines, infrastructure and guardrails without each team reinventing them. The goal is to reduce cognitive load rather than ask every developer to master the whole stack.
No. A portal is only the front door; the platform is the APIs, automation and guardrails behind it. Many successful platforms start with Git repositories, templates and a CLI, then add Backstage or a SaaS portal such as Port when discoverability and a software catalog become the bottleneck.
If you are new to the field, take the CNPA for the vocabulary and concepts, then the CKA or CKAD to prove hands-on Kubernetes skills. The CNPE is a performance-based exam that assumes you can already work with GitOps, platform APIs, observability and policy on Kubernetes, so it fits near the end of this path.
With a DevOps or cloud background and about 10 hours a week, this path takes around seven months. Engineers coming from application development usually need extra time on Kubernetes and cloud networking, while experienced Kubernetes administrators can move faster through the early stages.
Go is the language of Kubernetes, controllers, Crossplane functions and most cloud native tools, so it is the most valuable to learn. Python is excellent for automation and glue code, and TypeScript helps if you will build Backstage plugins.
Track voluntary adoption of golden paths, DORA delivery metrics for onboarded teams, developer satisfaction and friction from regular surveys, and platform SLOs such as pipeline and provisioning reliability. Combine quantitative and qualitative data, as the CNCF maturity model recommends, and avoid vanity metrics such as the number of templates.
AI coding agents are becoming platform users, so platforms now expose capabilities through MCP servers and APIs as well as portals. DORA's 2025 research found that high-quality platforms are what turn AI gains into organisational performance, which makes golden paths, policy guardrails, agent identity and audit more important, not less.
Join DevOpsSchool instructor-led programs with hands-on labs, real-world projects and certification guidance.
Roadmap reviewed October 2026 · Last updated 26 Oct 2026 · JSON