Career path

Platform Engineer

Give development teams a self-service internal platform, secure by default, where the right way to build, deploy and run is also the easiest one.

Aim for this jobWhat this job does

• 6 responsibilities
• 18 missions
• 68 skills
• 250 hours of work an estimate, starting from zero

Your gap

What you are missing

Aiming for this job computes your path from what you have already read and passed (quizzes, labs). You then see everything that remains from your first step.

335

lessons

~250 h

from zero

Aim for this job

Saved in this browser. Can be changed at any time.

The job

What a Platform Engineer does

Six responsibilities. Each one is carried out through concrete missions, which require skills.

1

Isolate and secure teams on the platform

Do on your own 4 missions · 12 skills

Missions that make it up

• Centralize user identity on an identity provider

  Deliverablea persistent identity provider with its realm, users, groups, roles and event logs, and an application connected with OpenID Connect whose tokens are validated

  • Set up Keycloak on PostgreSQL and administer a realm: users, groups, roles and event logs
  • Connect an application to an identity provider with OpenID Connect, validate its tokens and troubleshoot an OIDC or SAML integration

  2 skills No lab yet

• Provide secrets and identities to applications

  Deliverableeach application with a minimal identity and vault access limited to its paths, its secrets issued with a bounded lifetime or mounted from a Kubernetes Secret, never written into its image or manifests

  • Store a secret in a vault and read it without ever writing it in clear
  • Scope access to a vault to the strict minimum and explain a denial
  • Issue a secret with a bounded lifetime, renew it and revoke it in an emergency
  • Configure an application with ConfigMaps and Secrets
  • Give a workload a minimal identity (ServiceAccount)

  5 skills No lab yet

• Cap the resources of a platform's teams

  Deliverablequotas and resource ranges per team, an overrun refused by the cluster

  • Cap a namespace's resources

  1 skill No lab yet

• Open an isolated space for a team on a shared cluster

  Deliverablea space where the cluster refuses what is forbidden, where the team's identity can do almost nothing, and that nothing outside can reach

  • Give a workload a minimal identity (ServiceAccount)
  • Isolate traffic between Pods with NetworkPolicies
  • Harden a Pod's execution context (securityContext)
  • Authorize access to the Kubernetes API with RBAC
  • Make the cluster reject what breaks a security rule

  5 skills Proof lab

2

Provide golden paths to teams

Design and improve 4 missions · 13 skills

Missions that make it up

• Provide observability to teams

  Deliverablea standard telemetry collection, pipeline and instrumentation conventions, that teams plug into without rebuilding it

  • Instrument a service so it emits useful telemetry
  • Route telemetry through a collection pipeline

  2 skills No lab yet

• Ship an internal tool to other teams

  Deliverablean internal tool that is tested, reviewed, versioned and installable by other teams without help

  • Read, install and modify a small Python tool
  • Run pytest tests, read a failure and fix a simple defect
  • Review someone else's Python code and get your own checked
  • Make a Python tool installable and versioned

  4 skills Proof lab

• Standardise a team's CI

  Deliverablepipeline templates reused by several repositories, with their contribution rules

  • Document code: comments that say why, docstrings, generated reference
  • Give a repository its README, CHANGELOG and ADRs
  • Build and publish documentation checked in CI
  • Govern and tool an organization's CI

  4 skills No lab yet

• Publish a reference Helm chart for teams

  Deliverablea maintained chart, with a documented and validated values contract, signed and published to an OCI registry

  • Write a Helm chart: structure, templates, helpers and production patterns
  • Compose and harden charts: dependencies, values API, schema, tests and documentation
  • Publish trusted charts: RBAC rights, signing, OCI registry and CI/CD pipeline

  3 skills No lab yet

3

Operate the platform's runtime foundation

Do on your own 5 missions · 19 skills

Missions that make it up

• Observe the platform

  Deliverablea platform whose health, saturation and errors are collected, queryable, visualised and alerted on in a usable way

  • Query a service's metrics to answer an operations question
  • Collect a service's metrics and check their quality
  • Build a dashboard that answers an operations question
  • Define an actionable alert and route it without noise
  • Observe a cluster's health and resource usage

  5 skills No lab yet

• Bring a failing cluster back

  Deliverablea node, a control plane or name resolution restored, the cause found without a procedure

  • Troubleshoot cluster connectivity and DNS
  • Troubleshoot the control plane and nodes

  2 skills No lab yet

• Bring an application back on a cluster

  Deliverablean application answering again, its faults found with no ticket and no procedure

  • Expose an application with a Service, Ingress or Gateway
  • Provide persistent storage to an application
  • Control where Pods are placed
  • Troubleshoot a failing application on Kubernetes

  4 skills Proof lab

• Operate a Kubernetes cluster over time

  Deliverablea cluster installed, hardened to the CIS benchmark, observed, backed up and restored from its backup

  • Configure kubectl access to your clusters: kubeconfig, contexts and default namespace
  • Observe a cluster's health and resource usage
  • Install a Kubernetes cluster
  • Back up and restore a cluster's state
  • Run a cluster's operating routine
  • Maintain and manage nodes without service interruption
  • Harden a cluster's components with the CIS Benchmark

  7 skills No lab yet

• Upgrade a cluster without service interruption

  Deliverablea cluster moved to the next minor version, deprecated APIs migrated, nodes drained without outage

  • Detect and migrate deprecated APIs before an upgrade
  • Maintain and manage nodes without service interruption
  • Upgrade a kubeadm cluster by one minor version

  3 skills No lab yet

4

Enable self-service deployment

Do on your own 3 missions · 15 skills

Missions that make it up

• Deliver an application on Kubernetes from a specification

  Deliverablean application configured, probed, given a minimal identity, exposed and isolated, with no walkthrough

  • Expose an application with a Service, Ingress or Gateway
  • Configure an application with ConfigMaps and Secrets
  • Make a workload reliable: health probes and resources
  • Give a workload a minimal identity (ServiceAccount)
  • Isolate traffic between Pods with NetworkPolicies
  • Audit an application factor by factor (12-factor) on Kubernetes and fix its gaps

  6 skills Proof lab

• Deliver the same artefact to several environments

  Deliverablean artefact built once, promoted from staging to production reproducibly, under control and traceably, with configuration specific to each environment

  • Build an artifact once and promote it across environments
  • Update an application and roll back
  • Configure an application with ConfigMaps and Secrets
  • Make a workload reliable: health probes and resources
  • Design dynamic pipelines (variables, conditions, reuse)
  • Deliver to environments, artifacts included
  • Adapt manifests per environment with Kustomize
  • Change Kubernetes resources declaratively without drifting from Git

  8 skills No lab yet

• Deploy with GitOps

  Deliverablenotes-api deployed and promoted between two environments from Git

  • Deploy and observe an application on Kubernetes
  • Deploy an application with GitOps
  • Synchronize and promote across environments

  3 skills No lab yet

5

Describe the platform's infrastructure as code

Do on your own 1 mission · 6 skills

Missions that make it up

• Describe infrastructure as shareable, replayable code

  Deliverablean infrastructure split into versioned modules, its state shared and locked, replayed identically

  • Predict what an IaC tool will create, change or destroy: declarative model, idempotence, state and plan
  • Keep an IaC repository healthy: layered structure, plan review, testing pyramid and secrets out of the code
  • Structure infrastructure as code at scale: stacks, versioned modules, environments and debt
  • Share a remote, locked and recoverable Terraform state
  • Consume and version Terraform modules reproducibly
  • Design, structure and test a reusable Terraform module

  6 skills Proof lab

6

Guarantee trusted images and artefacts

Do on your own 1 mission · 7 skills

Missions that make it up

• Deliver a traceable artefact

  Deliverablea hardened image, its SBOM and a provenance attestation

  • Read an OCI image and check its integrity: index, manifest, config, layers and digests
  • Secure the installation and the containers
  • Harden the build, the images and the IaC
  • Produce an artifact's SBOM and qualify its vulnerabilities with a VEX
  • Publish an image to a registry: access token, tag, digest and publishing from CI
  • Sign an artifact, attest its provenance and verify it before deployment

  6 skills Proof lab

Also required, outside missions

• Assess your software supply chain's exposure and respond to a compromised component

The means

With which tools?

Choose your tools: the choice changes the lessons to read, never the responsibilities.

Continuous integration platform

GitHub Actions GitLab CI

GitOps tool

Argo CD Flux

Automation language

Python Go

Hypervisor

Incus

Going further

Specialisations

Optional, measured apart from the job.

Run the platform's secrets vault

• Run a vault in production: initialise, seal, back up and monitor it

Write the platform's tooling

• Read and transform data (JSON, YAML, APIs)
• Write a tested command-line tool
• Organize code into modules and publish a package on PyPI
• Manage Python versions, dependencies and installed tools (pyenv, pipx, Poetry)
• Test in isolation and across Python versions (unittest, mock, tox)
• Audit the quality and security of a project's code and dependencies
• Expose a REST API in Python and protect it with JWT
• Develop an Ansible module or plugin in Python

Set the platform's guardrails as Rego policies

• Write a correct Rego policy in OPA 1.x syntax, and predict what it returns
• Verify a Rego policy: tests, coverage, lint and CI checks
• Enforce Rego policies on configuration files in a CI pipeline
• Package, sign and distribute Rego policies to OPA instances

Run a self-service private cloud on Incus

• Describe and deploy instances in Terraform with the hypervisor's provider
• Secure an Incus server and its remote administration
• Administer Incus OS nodes through the API: seed installation, A/B updates, Tailscale, backup, monitoring and fleet
• Build and run an Incus cluster: joining, quorum and roles, workers, shared CephFS storage
• Isolate tenants on Incus: OVN VPCs, load balancer, ACLs, quotas, scoped credentials and a 3-tier deployment in Terraform

Build maintainable Python tools

• Manipulate lists, tuples, sets and slices in Python
• Design Python classes: encapsulation, inheritance, abc and mixins
• Run concurrent work and choose the right model
• Harden a Python test suite: Hypothesis, pytest fixtures, coverage and mutation
• Model and type data in Python with dataclasses, Enum and annotations
• Write idiomatic Python: decorators, generators, context managers and itertools
• Profile and optimize a Python program, up to a native extension

Work with an AI coding agent, under control

• Scope a task given to Claude Code and check its result with a plan, a diff and tests
• Confine Claude Code's execution: permissions, secrets and sandbox
• Automate and extend Claude Code with hooks, skills and plugins
• Connect an MCP server to Claude Code and delegate to isolated subagents
• Take back control of a drifting Claude Code session and troubleshoot its configuration
• Deliver a complete project driven by Claude Code, one vertical slice at a time
• Run Claude Code without an interactive session, in CI, with the right model and cost

Provide teams with a sovereign AI platform

• Explain how an LLM works, its inference and its quantization
• Write reliable prompts: roles, few-shot, Chain-of-Thought and ReAct
• Run and serve an open source LLM, from the workstation to the GPU
• Operate an LLM gateway: routing, fallback, cache, keys and budgets
• Trace LLM calls with OpenTelemetry GenAI up to Grafana Tempo
• Secure, test, authenticate and deploy MCP servers
• Have an agent run code in a hardened sandbox
• Assemble a sovereign AI stack and expose it behind a secured web interface
• Analyze an LLM application's risks with the OWASP Top 10 for LLM 2025 and choose defense-in-depth controls

Run and govern the platform's identity provider, and connect Kubernetes and Vault to it

• Protect an API with OAuth 2 tokens: audience, scopes, machine access and choosing the flow of a client without a browser
• Require a second factor per group in Keycloak, with forced enrolment and recovery, and set a password policy compliant with NIST SP 800-63B-4
• Manage the account lifecycle in Keycloak with SCIM and Workflows, handle a departure and run an access review
• Run Keycloak in production: TLS proxy, restored backup, version upgrade, emergency access and a realm described in Terraform
• Connect the Kubernetes API server and Vault to an OIDC identity provider, turn token groups into limited rights and diagnose a denial

Administer a self-hosted Git forge (Forgejo)

• Set up Forgejo on PostgreSQL behind a TLS proxy, reachable over HTTPS and SSH, then configure mail, LFS and sign-ups
• Govern access to Forgejo: organisations, teams and permissions, sign-in through an OIDC provider with an enforced second factor, and account support from the command line
• Monitor Forgejo through its logs and Prometheus metrics, fire an alert and diagnose a database outage
• Secure a Forgejo instance: webhooks kept off the internal network, brute force banned with fail2ban, a break-glass administrator account, scoped tokens and signed commits
• Back up Forgejo, copy the encrypted backup off the machine, restore it on a blank stack and write the recovery runbook
• Maintain Forgejo and upgrade it: scheduled tasks, doctor and quotas, an upgrade rehearsed on a copy with validation criteria and rollback from the backup

What the site does not cover yet

Developer portal (service catalogue, project templates) and reproducible development environments: being prepared (drafts platform.portal.catalog and dev.environment.provide). Disposable virtual machines are recommended; Nix, taught in the Linux course, stays outside the role (niche tool).

Golden paths (level 4): declared, not demonstrated while the Helm, standardised CI and team observability proofs are missing.

Delivering a secret from a vault to a Kubernetes workload (External Secrets Operator, CSI): taught since 2026-10-18 by the optional secrets-kubernetes lesson of the Kubernetes course (External Secrets Operator on a test provider, choice between CSI, Sealed Secrets, SOPS and Vault Agent Injector), assessed by its quiz, with no proof of autonomy for lack of a lab; attached as practice to k8s.workload.configure and k8s.access.authorize, no skill carries its contract. The vault, its access and its time-bounded secrets are in the core since 2026-10-14 (sec.secrets.store, access, lifecycle), unproven while the secrets labs are missing.

Around this job

Compare with another job →

All the skills →

×

See in the glossary →