Markdown Editor
Mở trình soạn thảo

Bộ mẫu vận hành nền tảng và cloud

Điều lệ và mức trưởng thành của platform team, golden path, thiết kế và nâng cấp Kubernetes, module IaC, vá lỗi, sao lưu, cảnh báo, tư thế bảo mật cloud, secret và phân bổ chi phí.

Bước 1

Chiến lược

  1. Internal Developer Platform Charter Template (CNCF Platforms)

    Đầy đủ

    Mission and outcomes, personas and job stories, scope on 13 CNCF capabilities, 7 attributes, interfaces, RACI, funding, SLOs, metrics, roadmap

    CNCF Platforms White Paper v1.0

  2. Platform Engineering Maturity Assessment Template (CNCF)

    Đầy đủ

    5 CNCF aspects by 4 levels, panel and method, evidence grades, ratings per aspect, current vs target profile, gaps, backlog, re-assessment

    CNCF Platform Engineering Maturity Model v1.0
Bước 2

Nền tảng

  1. Platform Golden Path Specification Template

    Chuẩn

    Golden path spec: target users, stack, scaffolding, CI/CD, environments, observability and security defaults, Backstage catalog

  2. Cloud Landing Zone Design Template (AWS, Azure, Google Cloud)

    Đầy đủ

    Principles, hierarchy diagram, identity and break-glass, hub-spoke and IP plan, guardrails, logging, policy as code, tagging, vending runbook, CIS mapping

    Azure landing zone design areas; AWS Control Tower multi-account guidance; Google Cloud landing zone design; CIS Benchmarks

  3. Kubernetes Cluster Design Template (Tenancy, Security, Operations)

    Đầy đủ

    Cluster or fleet design record: tenancy, hosting model, version cadence, node pools, CNI and NetworkPolicy, Gateway API, RBAC, Pod Security, backup, cost, hardening

    Kubernetes documentation (1.37); NSA/CISA Kubernetes Hardening Guidance v1.2

  4. IaC Module Specification Template (OpenTofu, Terraform)

    Đầy đủ

    One reusable IaC module: inputs and outputs, guardrails, security baseline, tagging contract, SemVer rules, tests and policy as code, deprecation

    SemVer 2.0.0; OpenTofu 1.13 and Terraform 1.17 module and test conventions
Bước 3

Vận hành

  1. Kubernetes Cluster Upgrade Runbook Template (Minor Version)

    Đầy đủ

    Minor-version upgrade runbook: support and skew check, deprecated API scan, add-on and CRD compatibility, PDB readiness, backups, control plane then nodes, verification, rollback limits

    Kubernetes release and version skew policy (1.37)

  2. Patch Management Policy Template (NIST SP 800-40 Rev. 4)

    Đầy đủ

    Patch and update policy: scope, maintenance groups, routine, expedited and emergency cadences, testing rings, windows, rollback, end-of-life software, mitigations, exceptions, metrics

    NIST SP 800-40 Rev. 4; CISA BOD 26-04

  3. Backup Policy Template (3-2-1-1-0, Immutability, NIST CP-9)

    Đầy đủ

    Organisation backup policy: data classes and backup tiers, numbered MUST/SHOULD statements, 3-2-1-1-0, immutable copies, retention, key escrow, ransomware isolation, restore tests, metrics

    NIST SP 800-53 Rev. 5 CP-9, CP-10; NIST CSF 2.0 PR.DS-11; 3-2-1-1-0 (industry convention)

  4. Observability Specification Template (OpenTelemetry)

    Đầy đủ

    Telemetry goals, OTel semantic conventions 1.44.0 baseline with stability per area, logs, metrics, traces, optional Profiles, dashboards, SLOs, alerts, privacy, retention, cost

    OpenTelemetry semantic conventions 1.44.0

  5. Alerting Policy Template (SLO Burn-Rate Alerts)

    Đầy đủ

    Symptom-based paging, page vs ticket vs log, multi-window burn-rate rules with worked numbers, alert metadata, naming, routing, noise budget, review, alerts as code

    OpenTelemetry semantic conventions 1.44.0; SLO burn-rate alerting

  6. Capacity Plan Template

    Đầy đủ

    Capacity plan: demand forecast with growth model, utilisation, headroom policy, resource models, bottlenecks, scaling, lead times, cost

Bước 4

Bảo mật

  1. Cloud Security Posture Review Template (CSA CCM v4.1)

    Đầy đủ

    Periodic cloud posture review: scope, shared responsibility, CSPM findings by CCM v4.1 domain, identity, exposure, data, logging, drift, risks, actions, trend

    CSA CCM v4.1 (domains and IDs); CIS Benchmarks named

  2. Secrets Management Standard Template (OWASP, NIST SP 800-57)

    Đầy đủ

    Secrets standard: classes, inventory, approved stores, issuance, rotation, workload identity, CI/CD and Kubernetes rules, scanning, leak response, break-glass

    OWASP Secrets Management Cheat Sheet; NIST SP 800-57 Pt 1 Rev. 5; SP 800-53 Rev. 5
Bước 5

Quản lý chi phí

  1. Cost Allocation and Tagging Standard Template (FinOps, FOCUS 1.4)

    Đầy đủ

    Allocation hierarchy, tag dictionary, MUST/SHOULD policy, policy as code, untaggable and shared-cost rules, showback vs chargeback, FOCUS 1.4 map, KPIs

    FOCUS 1.4; FinOps Framework 2026

  2. Cloud Cost Review Template (FinOps FOCUS 1.4)

    Đầy đủ

    Periodic cloud and technology cost review: FOCUS 1.4 metrics, allocation per tagging standard, unit economics, anomalies, commitments, FinOps 2026 capabilities

    FinOps FOCUS 1.4; FinOps Framework (2026 edition)