Markdown Editor
Open the editor

Platform and Cloud Operations Kit

Platform team charter and maturity, golden paths, Kubernetes design and upgrades, IaC modules, patching, backup, alerting, cloud posture, secrets and cost allocation.

Step 1

Strategy

  1. Internal Developer Platform Charter Template (CNCF Platforms)

    Full

    Mission and outcomes, personas and job stories, scope on 13 CNCF capabilities, 7 attributes, interfaces, RACI, funding, SLOs, metrics, roadmap

    CNCF Platforms White Paper v1.0

  2. Platform Engineering Maturity Assessment Template (CNCF)

    Full

    5 CNCF aspects by 4 levels, panel and method, evidence grades, ratings per aspect, current vs target profile, gaps, backlog, re-assessment

    CNCF Platform Engineering Maturity Model v1.0
Step 2

Foundation

  1. Platform Golden Path Specification Template

    Standard

    Golden path spec: target users, stack, scaffolding, CI/CD, environments, observability and security defaults, Backstage catalog

  2. Cloud Landing Zone Design Template (AWS, Azure, Google Cloud)

    Full

    Principles, hierarchy diagram, identity and break-glass, hub-spoke and IP plan, guardrails, logging, policy as code, tagging, vending runbook, CIS mapping

    Azure landing zone design areas; AWS Control Tower multi-account guidance; Google Cloud landing zone design; CIS Benchmarks

  3. Kubernetes Cluster Design Template (Tenancy, Security, Operations)

    Full

    Cluster or fleet design record: tenancy, hosting model, version cadence, node pools, CNI and NetworkPolicy, Gateway API, RBAC, Pod Security, backup, cost, hardening

    Kubernetes documentation (1.37); NSA/CISA Kubernetes Hardening Guidance v1.2

  4. IaC Module Specification Template (OpenTofu, Terraform)

    Full

    One reusable IaC module: inputs and outputs, guardrails, security baseline, tagging contract, SemVer rules, tests and policy as code, deprecation

    SemVer 2.0.0; OpenTofu 1.13 and Terraform 1.17 module and test conventions
Step 3

Operations

  1. Kubernetes Cluster Upgrade Runbook Template (Minor Version)

    Full

    Minor-version upgrade runbook: support and skew check, deprecated API scan, add-on and CRD compatibility, PDB readiness, backups, control plane then nodes, verification, rollback limits

    Kubernetes release and version skew policy (1.37)

  2. Patch Management Policy Template (NIST SP 800-40 Rev. 4)

    Full

    Patch and update policy: scope, maintenance groups, routine, expedited and emergency cadences, testing rings, windows, rollback, end-of-life software, mitigations, exceptions, metrics

    NIST SP 800-40 Rev. 4; CISA BOD 26-04

  3. Backup Policy Template (3-2-1-1-0, Immutability, NIST CP-9)

    Full

    Organisation backup policy: data classes and backup tiers, numbered MUST/SHOULD statements, 3-2-1-1-0, immutable copies, retention, key escrow, ransomware isolation, restore tests, metrics

    NIST SP 800-53 Rev. 5 CP-9, CP-10; NIST CSF 2.0 PR.DS-11; 3-2-1-1-0 (industry convention)

  4. Observability Specification Template (OpenTelemetry)

    Full

    Telemetry goals, OTel semantic conventions 1.44.0 baseline with stability per area, logs, metrics, traces, optional Profiles, dashboards, SLOs, alerts, privacy, retention, cost

    OpenTelemetry semantic conventions 1.44.0

  5. Alerting Policy Template (SLO Burn-Rate Alerts)

    Full

    Symptom-based paging, page vs ticket vs log, multi-window burn-rate rules with worked numbers, alert metadata, naming, routing, noise budget, review, alerts as code

    OpenTelemetry semantic conventions 1.44.0; SLO burn-rate alerting

  6. Capacity Plan Template

    Full

    Capacity plan: demand forecast with growth model, utilisation, headroom policy, resource models, bottlenecks, scaling, lead times, cost

Step 4

Security

  1. Cloud Security Posture Review Template (CSA CCM v4.1)

    Full

    Periodic cloud posture review: scope, shared responsibility, CSPM findings by CCM v4.1 domain, identity, exposure, data, logging, drift, risks, actions, trend

    CSA CCM v4.1 (domains and IDs); CIS Benchmarks named

  2. Secrets Management Standard Template (OWASP, NIST SP 800-57)

    Full

    Secrets standard: classes, inventory, approved stores, issuance, rotation, workload identity, CI/CD and Kubernetes rules, scanning, leak response, break-glass

    OWASP Secrets Management Cheat Sheet; NIST SP 800-57 Pt 1 Rev. 5; SP 800-53 Rev. 5
Step 5

Cost management

  1. Cost Allocation and Tagging Standard Template (FinOps, FOCUS 1.4)

    Full

    Allocation hierarchy, tag dictionary, MUST/SHOULD policy, policy as code, untaggable and shared-cost rules, showback vs chargeback, FOCUS 1.4 map, KPIs

    FOCUS 1.4; FinOps Framework 2026

  2. Cloud Cost Review Template (FinOps FOCUS 1.4)

    Full

    Periodic cloud and technology cost review: FOCUS 1.4 metrics, allocation per tagging standard, unit economics, anomalies, commitments, FinOps 2026 capabilities

    FinOps FOCUS 1.4; FinOps Framework (2026 edition)