Linux Foundation Certified Cloud Native Platform Engineer

Sharing infrastructure saves money until one team harms another. You design networking, storage and compute for many tenants, and choose between namespaces, separate node pools and separate clusters according to the isolation each case needs.

• Namespaces, quotas and limit ranges as tenant boundaries
• Node pools and dedicated nodes for sensitive workloads
• When to use separate clusters
• Network design for tenants and shared services
• Storage classes and data isolation between tenants
• Noisy neighbors and fair resource sharing

You build A tenancy design for three teams with different isolation needs, deployed and tested for leaks between them.

Cloud-native cost stays invisible until someone measures it. You attribute spend to teams, compare requests with real usage, resize workloads, and tune autoscaling so that capacity follows demand.

• Attributing cluster cost to teams and services
• Requests against actual usage
• Cost tools such as OpenCost and what they measure
• Right-sizing with vertical and horizontal scaling
• Node autoscaling and bin packing
• Showback reports that teams will read

You build A cost report per team with right-sizing recommendations, and the changes applied and measured.

GitOps makes a repository the record of what runs. You structure repositories for platform and application teams, drive clusters from them with Argo CD or Flux, handle secrets and drift, and promote changes between environments.

• Repository layouts for platform and application teams
• Pull-based reconciliation with Argo CD and Flux
• Promoting changes from development to production
• Handling secrets in a GitOps flow
• Drift: detecting it and deciding what to do
• Bootstrapping a new cluster from Git

You build A Git repository that bootstraps a cluster and promotes one application through three environments.

Delivery is only as trustworthy as the pipeline before it. You build pipelines that test, scan and package software, publish images by digest, and hand off to GitOps without anyone touching the cluster by hand.

• Pipeline stages: build, test, scan, publish
• Pipelines that run on Kubernetes, such as Tekton
• Image tags, digests and provenance
• Pipeline credentials and least privilege
• Updating the GitOps repository from a pipeline
• Reusable pipeline templates for many teams

You build A reusable pipeline template that builds, scans and publishes an image, then proposes the change in the deployment repository.

Releasing to everyone at once is a bet. You shift traffic gradually, let metrics decide whether a release continues, and roll back automatically when they say it should.

• Blue/green and canary compared
• Traffic shifting with a mesh or gateway
• Argo Rollouts and Flagger
• Analysis templates driven by metrics
• Automatic promotion and rollback rules
• Feature flags as a complement to rollouts

You build A canary release that promotes itself while error rate and latency stay healthy, and aborts when they do not.

A good platform API lets a developer ask for a database without learning how it is built. You design custom resources and their schemas, validate input, report status, and compose infrastructure behind a simple surface.

• Designing a CRD around what developers ask for
• Schemas, defaults and validation rules
• Status fields and conditions that explain what happened
• Versioning and conversion
• Composing resources with Crossplane
• Hiding cloud details behind one claim

You build A database API, as a custom resource, that provisions a real instance and reports its status.

Self-service is a workflow, not a form. You connect templates, approvals and automation so that a team can create an environment or a service and see it appear through Git, with sensible defaults and guardrails.

• Service templates and scaffolding
• Requests that become pull requests
• Approvals and guardrails that do not slow everyone down
• Developer portals as the front door
• Ephemeral preview environments
• Offboarding: deleting what is no longer used

You build A self-service flow that creates a new service with its repository, pipeline, namespace and dashboard.

When an API needs behavior, a controller supplies it. You write a reconcile loop with a controller framework, handle ownership and cleanup correctly, and decide when an operator is worth its maintenance cost.

• The reconcile loop and idempotent logic
• Building a controller with Kubebuilder
• Owner references, finalizers and cleanup
• Handling failure and requeue
• Testing a controller
• Operator or plain automation: a decision framework

You build A small operator that reconciles one custom resource, with tests for failure and deletion.

A platform must tell its owners when it is unwell. You collect metrics, logs and traces, define service level objectives, alert on symptoms, measure delivery performance, and run incidents with clear steps.

• Metrics, logs and traces for platform components
• Service level objectives and error budgets
• Alerts that page for symptoms, not causes
• Tracing a request across the platform
• Delivery metrics such as deployment frequency and recovery time
• Incident response and blameless review

You build A platform dashboard with objectives and alerts, and an incident runbook tested on a simulated outage.

Guardrails belong in the platform, not in a document. You enforce RBAC and policy at admission, secure traffic between services, keep audit trails, and scan what flows through the pipeline.

• RBAC design for platform teams and tenants
• Admission control with Kyverno, Gatekeeper and validating policies
• Mutual TLS between services
• Audit logs and who-did-what trails
• SBOMs and image scanning in the pipeline
• Exceptions: granting them without breaking the rule

You build A policy set that blocks unsafe workloads at admission and records every exception.

Assemble a thin but complete platform for a small organization: tenancy, delivery, a self-service API, observability and policy. You deploy it, onboard a team, and show what it costs and what it protects.

• Scoping a platform for three teams
• Wiring GitOps, pipelines and progressive delivery
• Publishing one self-service capability
• Instrumenting and securing the whole
• Onboarding a team and collecting feedback
• Presenting cost, risk and the roadmap

You build A running platform that takes a team from request to deployed, observed and policy-checked services without tickets.