Certified Cloud Native Platform Engineer Roadmap

Start with user outcomes, trust boundaries, failure domains, and cost. A platform is not a pile of tools; it is a supported product with versioned interfaces.

• Read the public CNPE curriculum and CNCF Platforms White Paper.
• Define developer personas, repeated jobs, support model, and platform non-goals.
• Design networking, Gateway API, storage, compute, DNS, identity, and external dependencies.
• Compare namespace, node, and cluster isolation for different tenant risks.
• Apply requests, limits, quotas, topology spreading, disruption controls, and capacity headroom.
• Model cost from idle environments, preview capacity, storage, telemetry, and failure reserve.
• Write architecture decisions with owners, assumptions, rejected options, and review triggers.

Evidence: a platform product brief, tenancy matrix, architecture diagram, capacity model, and cost guardrails.

Follow one change from reviewed source to immutable artifact, desired state, admission, progressive exposure, and recovery.

• Separate source, artifact, and environment-configuration responsibilities.
• Build once, record a digest, and promote the same artifact.
• Generate tests, SBOM, scan, signature, and provenance evidence.
• Configure a pull reconciler with scoped repository and cluster access.
• Test drift, pruning, dependency order, health, and disaster bootstrap.
• Implement canary analysis and a blue-green preview with explicit abort behavior.
• Plan database compatibility before treating rollback as safe.
• Measure lead time, deployment frequency, change failure, and recovery together.

Evidence: a verified source-to-runtime chain, GitOps drift tests, rollout analysis, rollback exercise, and balanced delivery scorecard.

Turn repeated operational knowledge into small, stable contracts that hide unnecessary complexity while preserving status and control.

• Design a structural CRD with validation, defaults, status, conditions, and observed generation.
• Implement idempotent reconciliation, retries, owner references, and finalizers.
• Compose workload and optional infrastructure resources behind one user-facing request.
• Version the API and define conversion, migration, compatibility, and deprecation.
• Expose the workflow through a Backstage template or equivalent interface.
• Keep schema, admission, RBAC, and policy enforcement server-side.
• Create a governed extension and exception path rather than forcing every workload through one template.
• Measure request success, time to Ready, pending age, abandonment, and support burden.

Evidence: a versioned self-service API, tested controller, portal workflow, lifecycle tests, and developer-outcome dashboard.

Instrument both user-facing workflows and the controllers, queues, policies, and dependencies that make the platform converge.

• Define SLIs and SLOs for provisioning, delivery, service availability, and platform control paths.
• Collect metrics, logs, traces, events, and audit records with bounded dimensions.
• Monitor reconciliation duration, error, retry, queue depth, work age, and generation lag.
• Build actionable alerts with ownership, impact, evidence, and runbooks.
• Practice incidents involving rollout failure, API throttling, storage pressure, zone loss, and stale telemetry.
• Separate facts, hypotheses, unknowns, and degraded coverage.
• Test backups and restore external identity, keys, DNS, data, controllers, and user journeys.
• Revisit capacity and cost after every reliability change.

Evidence: SLO dashboards, controller telemetry, low-noise alerts, incident timelines, capacity findings, and measured recovery.

Integrate security into identity, networking, artifacts, admission, audit, and emergency operations, then practice complete tasks under time pressure.

• Apply least-privilege RBAC for users, workloads, controllers, and delivery systems.
• Combine NetworkPolicy with authenticated encrypted service communication.
• Verify exact artifact digest, expected signer, issuer, source, builder, and evidence freshness.
• Test admission with valid, invalid, mutated, upgrade, timeout, certificate, and outage fixtures.
• Use exact, owned, approved, expiring exceptions and preserve them as exceptions in reports.
• Build audit trails from source review through deployment and API activity.
• Complete all three projects, review flashcards, and repeat weak-domain scenarios.
• Practice task triage, context checking, verification, rollback, and cleanup in a disposable Linux environment.

Evidence: policy tests, denied-path matrix, audit chain, timed lab results, remediation notes, and an exam-day checklist.