Learning Platform Engineering · concepts → domains → practice

Turn raw Kubernetes into a platform developers love.

A self-paced, beginner-friendly path into cloud native platform engineering — the craft of building an internal developer platform (IDP) so your developers can ship safely without filing a ticket for every database, environment, and deploy. You’ll learn the mindset (platform as a product, golden paths), then the five things a platform engineer must actually do: shape the architecture, wire up GitOps & delivery, expose self-service APIs, run observability, and enforce security & policy. It doubles as a complete study companion for the Certified Cloud Native Platform Engineer (CNPE) exam. Comfortable with basic Kubernetes? Great. That’s all you need to start.

Ticketsfile & wait
Scriptsshared but manual
CI/CDautomated pipelines
GitOpsGit is the control panel
Self-Servicerequest via the platform
Golden Pathspaved road, self-serve
MOST TOIL — a human runs every changeMOST FLOW — developers self-serve on guardrails →
☺ Like you’re 10

Imagine a town where every time you want a snack, you fill in a form and wait three days for a grown-up to make it for you. Exhausting, right? A platform is like building a safe, well-stocked kitchen where kids can make their own snacks — with guardrails so nobody burns the house down. Platform engineering is the job of building that kitchen for software developers, so they can cook (ship apps) themselves instead of waiting in line. This course teaches you how to build the kitchen — and the paved “golden path” that leads to it.

⚠ Independent & unofficial

Learning Platform Engineering is an independent, third-party educational resource. It is not affiliated with, endorsed by, or an official product of the Cloud Native Computing Foundation (CNCF) or The Linux Foundation. “CNPE,” “CNPA,” “CKA,” “Kubernetes,” and the names of CNCF projects are trademarks of their respective owners, used here only to describe what this course helps you learn. Exam format, price, and curriculum change — always verify current details on the official CNCF and Linux Foundation pages.

How the course is built

☺ Like you’re 10: First you learn why platforms exist and how to think about them. Then you learn the five real jobs a platform engineer does. Then you practice until it sticks.

The course has three parts. Platform Foundations gives you the mindset — what an internal developer platform is, why “treat the platform as a product” is the whole game, and the reference architecture the pros reuse. The Exam Blueprint then walks the five official CNPE domains one at a time, in depth, with real CNCF tools and real manifests. And Exam Prep cements it with a common-preparation kit (how to study, the Kubernetes baseline, exam day, flashcards, a self-check quiz and a readiness checklist), a CNPE drill kit, and a full CNPA sub-course — with the tool landscape, case studies and a searchable glossary alongside in Practice & Reference.

Mindset · start here

Platform Foundations

What platform engineering is, cognitive load & developer experience, platform as a product, golden paths, and the CNCF platform reference architecture. Start the foundations →

The exam · 5 domains

The Exam Blueprint

The same five domains the CNPE tests: architecture, GitOps & delivery, platform APIs, observability, and security & policy — hands-on, with Argo, Crossplane, Prometheus, Kyverno & more.

Practice · remember it

Practice & Exam Prep

Cement it: the tool landscape, real case studies, a searchable glossary, flashcards, a self-check quiz, a two-exam readiness checklist, and the CNPA sub-course for the associate paper.

Meet the Platform Guild

☺ Like you’re 10: To make the big ideas stick, this course is taught by a team of animal friends. Each one is an expert at one platform job — so the moment the beaver shows up, you know it’s time to build and ship.

Every big idea has a recurring character who is that idea — 🦉 Professor Owl draws the platform blueprint, 🐼 Master Panda keeps cognitive load low, 🦊 Foxy asks the question you’re thinking, 🐿️ Nutty discovers what developers actually need, 🦫 Benny the Beaver builds the delivery machinery, 🐘 Ellie the Elephant never forgets a metric or an incident, 🦋 Mira the Butterfly turns ugly YAML into self-service, and 🐢 Timmy the Turtle installs the guardrails — all in service of 🦆 Dot the Duck, the developer who just wants to ship. Meanwhile 🤖 Recon the Robot tirelessly makes reality match the plan, and 👺 Gizmo the Gremlin tempts everyone into shortcuts. Watch for the “Your hosts for this topic” strip and the little 🎬 At the Platform Guild scenes in each lesson.

Meet the full cast and see how it works → The Platform Guild

The one mental model that makes it all click

☺ Like you’re 10: A platform isn’t a pile of tools you force on people. It’s a product — and your developers are the customers. If they don’t love using it, you built the wrong thing.

Before any tool or YAML file, internalize this: a platform is a product, and your developers are its customers. You don’t win by mandating Kubernetes knowledge for everyone; you win by paving golden paths — the supported, well-lit, secure-by-default way to do the common things (spin up a service, get a database, ship to prod). Golden paths are optional but so good that people choose them. Get that right and every domain below is just execution: GitOps is how the path stays paved, self-service APIs are how developers walk it alone, observability is how you know it’s working, and policy is the guardrail that keeps them safe.

Hold that idea. Most of this course is just filling in the golden path — how to build it, expose it, watch it, and guard it so developers self-serve without fear.

The platform, end to end

☺ Like you’re 10: One picture, one wish. Dot asks for a service; it flows right through three floors of the platform, while two more floors watch and guard every step.

Every domain you’re about to study is one plane in this picture, and every request moves through it left to right. Dot declares intent in the Control plane, the Delivery plane builds and provisions it, and the Resource plane runs it — while Observability watches and Security gates every single step. This is the master diagram for the whole course; the Reference Architecture lesson is where it’s unpacked in full.

🐘 Observability Plane — metrics · logs · traces · dashboards 🐢 Security Plane — RBAC · admission policy · secrets · signing 🦆 Dot wants to ship 🦋 Control Backstage · Score CLI · GitOps 🦫 Delivery Argo/Flux · CI Crossplane ☁️ Resource cluster · storage database intent provision

The exam, at a glance

☺ Like you’re 10: The CNPE is a “show me, don’t tell me” test — you don’t pick A/B/C, you actually fix real things on a real computer.

The Certified Cloud Native Platform Engineer (CNPE) is a hands-on, performance-based exam launched by the CNCF and Linux Foundation in late 2025. You solve real tasks in a live Linux environment — no multiple choice. Here’s the shape of it (always confirm on the exam guide and the official pages):

ItemDetail
FormatOnline, proctored, performance-based (solve tasks in a Linux remote desktop — terminal & web UIs)
Length120 minutes
Cost$445 (includes one free retake); bundles with a THRIVE subscription exist
Validity2 years
PrerequisitesNone — though CNPA (the associate) or hands-on platform experience helps
LevelIntermediate → senior (Principal Platform Engineer, Platform Architect, SRE/DevOps lead)

Full exam guide, registration & a study plan →

The five domains, by weight

☺ Like you’re 10: The test spends more time on some topics than others. The two biggest — GitOps and self-service — are each a quarter of the whole thing, so lean in there.

The CNPE blueprint splits the platform engineer’s job into five domains. The bars show how much of the exam each one is worth — a useful map for where to spend your study time:

What’s inside

☺ Like you’re 10: The lessons stack like levels in a video game — each one uses what you learned in the level before, so you keep getting stronger.

01 · Start here

What & Why We Platform

Why platform engineering exists: cognitive load, the internal developer platform, developer experience, and Team Topologies.

02 · Foundations

Platform as a Product

The core mindset: golden paths, the thinnest viable platform, treating developers as customers, and measuring what they love.

03 · Foundations

The Reference Architecture

The CNCF platform capabilities model: the developer control plane, integration & delivery, resource, observability, and security planes.

D1 · 15%

Architecture & Infrastructure

Networking, storage & compute best practices; multi-tenancy (namespaces vs clusters vs vClusters); cost, right-sizing & autoscaling.

D2 · 25%

GitOps Workflows

The four OpenGitOps principles, Argo CD vs Flux, reconciliation & drift, ApplicationSets, and repo structure for apps + infra.

D2 · 25%

CI/CD & Progressive Delivery

Pipelines integrated with Kubernetes (Tekton, Argo Workflows) and safe rollouts — blue/green & canary with Argo Rollouts & Flagger.

D3 · 25%

Platform APIs, CRDs & Operators

Custom Resource Definitions, the operator/controller pattern, reconciliation loops, and the frameworks that build them.

D3 · 25%

Self-Service & Portals

Crossplane compositions as an infra API, Backstage as the golden-path storefront, and automation frameworks for provisioning.

D4 · 20%

Observability & Operations

Metrics, logs & traces (Prometheus, OpenTelemetry, Grafana); golden signals; SLI/SLO/error budgets; DORA; incident triage.

D5 · 15%

Security & Policy

mTLS & service mesh, RBAC, admission control with OPA/Gatekeeper & Kyverno, supply-chain security, SBOMs & audit trails.

⚑ · Operating

Anti-Patterns & Pitfalls

Gizmo’s traps: the platform nobody asked for, ticket-ops in disguise, over-abstraction, snowflake clusters — and the fix for each.

✦ · Operating

Best Practices & Operating Model

Team Topologies, the thinnest viable platform, running the platform as a product, and how to measure that it’s working.

🧪 · Hands-On

The Capstone Hub

Build one real mini platform on a local cluster across six deep, connected parts — GitOps, a canary, a platform CRD, a Backstage portal, observability & policy — or take the 9-item fast path. Progress saved.

★ · Reference

The Tool Landscape

Every project on the CNPE tool list — Argo, Crossplane, Flux, Kyverno, OPA, Prometheus, OTel, Istio & more — mapped to the job it does.

◆ · Reference

Platform Case Studies

Eight real-world & composite case files — Spotify & Backstage, Mercedes-Benz, adidas & Zalando, CERN, Monzo, Netflix, plus two composite cautionary tales — and the lesson from each.

🎯 · Reference

The CNPE Exam

Format, registration, cost, the exam environment, a 10-week study plan, and terminal-speed tips for the performance test.

…plus a searchable glossary in the sidebar under Practice & Reference, and the shared drills — field notes, flashcards, a self-check quiz and a printable readiness checklist — under Exam Prep · Common preparation.

Go deeper — Platform Engineering in depth

☺ Like you’re 10: The exam is just the start. Platform engineering is a huge world — so there’s a whole extra shelf of deep-dive lessons on the big topics the exam only touches.

The five CNPE domains are the core, but the discipline is vast. This Platform Engineering in Depth track goes well beyond the blueprint — each page is a thorough deep-dive with many sections and subsections, real CNCF tools, diagrams, and code. Read them to become a platform engineer, not just a certified one.

☸️ · In Depth

Kubernetes as the Substrate

The control plane, API machinery, the object model, controllers, and how Kubernetes became a platform for building platforms.

🔌 · In Depth

Networking & Connectivity

The pod network model, CNI & eBPF, Services & kube-proxy, DNS, Ingress vs the Gateway API, and service mesh compared.

🗄️ · In Depth

Storage & Stateful Workloads

CSI, PV/PVC & StorageClasses, StatefulSets, databases-on-Kubernetes operators, and backup/DR with Velero.

📦 · In Depth

Configuration & Packaging

Helm vs Kustomize vs jsonnet/KCL, how config feeds GitOps, and workload abstractions like Score & KubeVela.

🏗️ · In Depth

IaC & Control Planes

Terraform/OpenTofu & Pulumi vs the control-plane model (Crossplane, Cluster API) — one-shot apply vs continuous reconciliation.

🔐 · In Depth

Secrets & Workload Identity

Vault, External Secrets, Sealed Secrets & SOPS, dynamic secrets, and the endgame — SPIFFE/SPIRE & workload identity.

⚡ · In Depth

Developer Experience

Inner vs outer loop, local dev (Tilt, Skaffold, Telepresence), preview environments, and measuring DevEx (DORA, SPACE).

🚀 · In Depth

Release Engineering & Artifacts

Image building (Buildpacks, Kaniko, ko), distroless, OCI registries, promotion, feature flags, and supply-chain signing.

🌐 · In Depth

Multi-Cluster & Fleet

Why multiple clusters, Cluster API, fleet GitOps (ApplicationSets, Fleet, Sveltos), cluster mesh, and Karmada.

🛡️ · In Depth

Reliability, SLOs & Incidents

SRE for platforms, SLIs/SLOs/error budgets, resilience patterns, incident command, postmortems, and chaos engineering.

📈 · In Depth

Scaling, Scheduling & Performance

The scheduler, affinity & topology, HPA/VPA, Cluster Autoscaler vs Karpenter, KEDA scale-to-zero, and cluster limits.

💰 · In Depth

FinOps & Cost Optimization

OpenCost, showback vs chargeback, right-sizing, spot & commitments, waste elimination, budgets, and GreenOps.

⚖️ · In Depth

Governance & Compliance

Tenancy models (HNC, vCluster, Capsule), policy at scale, SOC 2/PCI/FedRAMP, audit evidence, and access governance.

👥 · In Depth

Team Topologies & Org Design

Conway’s Law, the four team types & three interaction modes, cognitive load, and the reverse Conway maneuver.

🗺️ · In Depth

The Cloud Native Landscape

The CNCF, project maturity (sandbox→graduated), how to evaluate a project, build-vs-buy, and avoiding tool sprawl.

🧠 · In Depth

Platforms for AI/ML & Data

MLOps on Kubernetes, GPU scheduling, Kubeflow & Ray, model serving (KServe, vLLM), and the LLMOps stack.

📡 · In Depth

Edge, WASM & the Future

Edge Kubernetes (k3s, KubeEdge), server-side WebAssembly, Knative, platform orchestrators (Kratix, Score), and AIOps.

Tools used in Platform Engineering

☺ Like you’re 10: A platform is built from about thirty tools. Each one now has its own full page — what it’s for, how it works, the exact YAML you write, and what usually goes wrong.

The lessons teach the jobs; this section covers the tools that do them. 31 dedicated pages, each with architecture, the resources you actually write, day-to-day commands, gotchas, and a comparison against its rivals. marks the tools named on the official CNPE curriculum; marks the wider ecosystem you’ll still meet in real work. Start at the Tool Landscape for the map.

AreaTools
GitOps & deliveryArgo CD ★ · Flux ★ · Argo Rollouts ★ · Flagger ★ · Argo Workflows ★ · Tekton
Config & packagingHelm ◆ · Kustomize
Platform APIsCrossplane ★ · Backstage ◆ · Kubebuilder ◆ · Cluster API
Observability & costPrometheus ★ · Grafana ★ · OpenTelemetry ★ · Jaeger ★ · Loki ◆ · OpenCost
Security & policyKyverno ★ · OPA & Gatekeeper ★ · cert-manager ◆ · Trivy ◆ · Sigstore & cosign ◆ · Falco ◆ · External Secrets
Networking & meshIstio ★ · Linkerd ★ · Cilium
Scaling & resilienceKEDA ◆ · Karpenter ◆ · Velero

Certifications — the whole landscape

☺ Like you’re 10: There are lots of badges you can earn. This tells you which ones are worth it, in what order — and which to skip.

The CNPE is the headline, but it sits in a ladder. Which cert? maps the whole landscape and recommends a path for your starting point. Each certification below has its own page with the official domains and weights, what it actually tests, and how to prepare using this site — including an honest verdict on when to skip it.

25 pages in all: the map itself, the 13-exam CNCF ladder (one programme, one set of rules, from KCNA up through CKS and the project associates), and 11 more grouped by the provider that sells them — PlatformEngineering.org · HashiCorp · AWS · Microsoft · Google Cloud · Red Hat · Linux Foundation · GitHub · GitLab · PeopleCert & DASA. Provider, not subject, is what sets the price, the format, the validity period and the renewal mechanics, so that is how they are grouped — and the sidebar is grouped identically, so the map and the menu agree.

🎓 · Start here

Which Cert Should I Take?

The full ladder, recommended paths for five different starting points, and how studying for a knowledge exam differs from a hands-on one.

📘 · Sub-course

CNPA — the associate cert

The knowledge-based counterpart to the CNPE, with a full sub-course: all six official domains, a four-week study plan, four practice banks, and four 60-question mock papers.

☸️ · CNCF ladder

The Kubernetes ladder

KCNA, CKA, CKAD, CKS and KCSA — the cluster skills the CNPE assumes you already have.

🔁 · CNCF ladder

Project associates

CGOA (GitOps), CAPA (Argo), CBA (Backstage), ICA (Istio), CCA (Cilium), KCA (Kyverno), OTCA (OpenTelemetry) and PCA (Prometheus).

🏛️ · PlatformEngineering.org

Platform Engineering Practitioner

The vendor-neutral cert about the discipline — platform as a product, adoption, golden paths — rather than one vendor’s tooling.

🏗️ · HashiCorp

Terraform & Vault

Terraform Associate for infrastructure as code, and Vault Associate for secrets engines, dynamic credentials and Kubernetes auth.

☁️ · AWS · Microsoft · Google Cloud

The cloud DevOps trio

AWS DevOps Engineer Pro, Azure AZ-400 and Google Cloud DevOps Engineer — whichever cloud your platform actually runs on.

🎩 · Red Hat · Linux Foundation

OpenShift, RHCSA & LFCS

Red Hat’s performance-based line, plus LFCS — the Linux fluency under every cluster, and Golden Kubestronaut’s sixteenth exam.

🐙 · GitHub

GitHub Certifications

The GH- exam family on Microsoft Learn — Actions, Advanced Security, administration — because that is usually where your pipelines live.

🦊 · GitLab

GitLab Certifications

The five Associate exams on GitLab University, led by Certified CI/CD Associate — the one that sits on this site’s delivery domain.

📐 · PeopleCert & DASA

SRE & DevOps practice

The practice-and-process credentials — useful vocabulary for reliability work, thin on hands-on proof.

Straight to a page: CNCF ladder — KCNA · KCSA · CKA · CKAD · CKS · CGOA · CAPA · CBA · CCA · ICA · KCA · OTCA · PCA. By provider — PlatformEngineering.org · Terraform · Vault · AWS · AZ-400 · Google Cloud · Red Hat · LFCS · GitHub · GitLab · SRE practice.

Hands-On Labs — a 6-part capstone build + 7 guided-drill tracks

☺ Like you’re 10: Reading about it isn’t doing it. These are the “get your hands dirty” pages — including one where you break things on purpose so you learn to fix them fast.

The CNPE is performance-based, so labs are the highest-value prep on this site. Start with the Capstone Hub, which now walks you through one real mini platform grown across six deep, connected parts — foundation, delivery, platform APIs, self-service, observability, and security — instead of nine disconnected exercises (short on time? the hub still keeps its original 9-item fast path). Then drill whichever domain you’re weakest in with the seven guided-drill tracks. Every lab has objective “done when” criteria, and your progress saves in the browser.

🧪 · Capstone hub

Build a Platform — start here

One continuous build across six parts, or the 9-item fast path if you’re short on time. Start here before the deep parts below.

1 · Capstone

Part 1 — Foundation

A kind cluster, Argo CD installed, an apps/ App-of-Apps reconciling — drift reverted, Git deletions pruned.

2 · Capstone

Part 2 — Delivery

A Kubernetes-native pipeline building the ledger image, shipped via an Argo Rollouts canary that auto-aborts a bad version.

3 · Capstone

Part 3 — Platform APIs

A new noun for “ledger” — an operator or a Crossplane XRD/Composition — that reconciles and self-heals a deleted child object.

4 · Capstone

Part 4 — Self-Service

Backstage running, ledger in the Software Catalog, and a Software Template that scaffolds a new service already wired.

5 · Capstone

Part 5 — Observability

kube-prometheus-stack, a ServiceMonitor, a golden-signals Grafana dashboard, a firing alert, and a triaged, deliberately broken pod.

6 · Capstone

Part 6 — Security & Golden Path

Policy, RBAC, NetworkPolicy, mTLS, a Trivy scan, tenancy and cost visibility — and every part chained into one automatic golden path.

🦫 · 12 labs

GitOps Labs

Argo CD and Flux hands-on: self-heal, sync waves, ApplicationSets, PR preview environments, image automation.

🚀 · 12 labs

CI/CD & Delivery Labs

Tekton pipelines and workspaces, Kaniko builds, Argo Rollouts canary with analysis, blue-green, Flagger.

🦋 · 12 labs

Platform API Labs

CRDs with schemas and subresources, a Kubebuilder controller, finalizers, Crossplane claims, a Backstage template.

🐘 · 12 labs

Observability Labs

ServiceMonitors, PromQL golden signals, alerting, Grafana as code, OTel → Jaeger, Loki, SLOs and burn-rate alerts.

🐢 · 12 labs

Security & Policy Labs

Default-deny networking, least-privilege RBAC, Kyverno audit→enforce, Gatekeeper, mTLS, Trivy, cosign, Falco.

🦉 · 12 labs

Architecture & Cost Labs

Quotas and tenancy, QoS and eviction, affinity and spread, PDBs, HPA/VPA/KEDA, storage, OpenCost.

🩹 · 15 drills

Break-Fix Drills

Sabotage it yourself, then fix it under a time box — CrashLoopBackOff, OOMKilled, blocked NetworkPolicy, stuck rollouts and more.

Exam Prep — the arsenal

☺ Like you’re 10: Reading about the test isn’t the same as practising for it. This is the drill kit: real tasks, the commands, what to memorise, and how to fix things fast.

Exam Prep is split three ways, exactly as the sidebar is. Common preparation is the part that applies whichever CNCF exam you sit. CNPE · professional is the performance-based drill kit. CNPA · associate is the knowledge-based sub-course. Work the common pages first; they are the cheapest hours you will spend.

Common preparation — before either exam

How to study, what Kubernetes you need before you start, and what the proctored sitting is actually like — plus the three shared drills that keep the material warm.

CNPE · professional — the performance-based drill kit

The CNPE is performance-based — officially 15–20 hands-on tasks in 120 minutes, pass mark 64%. You don’t pass by reading; you pass by having done it before and by being fast. These pages are the drill kit, including the thing most candidates get wrong: the documentation allowlist is narrow (Kubernetes docs only — not Argo CD, Crossplane or Prometheus), so a lot has to come from memory.

The practice bank splits into five per-domain sets — GitOps & CD, Platform APIs, Observability, Architecture and Security — and the triage playbook splits into workloads & storage, networking, RBAC & admission, and delivery, observability & platform APIs.

Ready for a timed sitting? Six full CNPE mock papersSet 1 · Set 2 · Set 3 · Set 4 · Set 5 · Set 6 — each 18 tasks in 120 minutes with a scoring sheet and a worked solution for every task. Sit Set 1 once you have worked the banks, and keep the later sets sealed so each one can still measure you.

CNPA · associate — the knowledge-based sub-course

The CNPA is multiple-choice and closed-book: no cluster, no terminal, and no documentation tab. It is the sensible first step before CNPE, and it has its own hub, plan, banks and papers here.

Straight to a page: practice banks — Core Fundamentals · Observability & Security · Delivery & APIs · IDP & Measuring. Mock papers — Set 1 · Set 2 · Set 3 · Set 4.

The closed-book reference kit

Four more pages built specifically for a knowledge-based, closed-book paper — no cluster, no terminal, and (unlike CNPE) no documentation tab at all.

⌁ A note on dates & versions

Cloud native tools move fast — project names, API versions, and exam details all drift. This course reflects the landscape in 2026; treat specific versions and prices as “true at time of writing” and verify live details in the official CNCF/Linux Foundation docs and each project’s documentation. The concepts — platform-as-a-product, GitOps reconciliation, the operator pattern, golden signals — are stable; the flags and version numbers are not.