This curriculum spans the design and operational rigor of a multi-workshop DevOps transformation program, addressing the same technical and organizational challenges encountered when establishing internal developer platforms and securing enterprise-scale CI/CD ecosystems.
Module 1: Establishing DevOps Principles and Organizational Alignment
- Define cross-functional team charters that clarify ownership of CI/CD pipelines between development and operations.
- Negotiate SLIs and SLOs with product stakeholders to align reliability goals with business outcomes.
- Implement blameless postmortem processes that require root cause analysis documentation and follow-up action items.
- Decide whether to adopt DevOps as a centralized enablement team or embed practitioners directly in product squads.
- Integrate feedback loops from support and monitoring systems into sprint planning to prioritize technical debt.
- Assess organizational maturity using the DORA metrics framework and identify baseline measurement gaps.
Module 2: Designing and Securing CI/CD Infrastructure
- Select between hosted (e.g., GitHub Actions) and self-hosted (e.g., Jenkins on Kubernetes) CI platforms based on compliance and scalability needs.
- Implement signed commits and pipeline provenance checks to enforce code origin verification.
- Configure parallel test stages with flaky test detection and quarantine mechanisms.
- Enforce pipeline-as-code standards using linting and mandatory peer review for .gitlab-ci.yml or similar.
- Design artifact promotion workflows using immutable versioned packages across environments.
- Isolate build agents using ephemeral containers and restrict network egress to approved registries.
Module 4: Infrastructure as Code and Environment Management
- Choose between Terraform and AWS CloudFormation based on multi-cloud requirements and state management tolerance.
- Implement module versioning and dependency pinning to prevent configuration drift in production.
- Structure environment configurations using overlays or workspaces to minimize duplication.
- Enforce pre-commit hooks that validate IaC syntax and security policies before merge.
- Automate drift detection by scheduling periodic plan executions and alerting on unapproved changes.
- Manage secrets using dedicated providers (e.g., HashiCorp Vault) instead of embedding in IaC templates.
Module 5: Observability and Runtime System Intelligence
- Standardize on structured logging formats and enforce schema compliance at ingestion.
- Configure metric retention policies that balance cost and debugging needs across environments.
- Design dashboard hierarchies that provide service-level views and aggregate system health.
- Implement synthetic transaction monitoring to detect degradation before user impact.
- Integrate distributed tracing with context propagation across service boundaries using OpenTelemetry.
- Set up alerting rules with clear runbook references and avoid notification flooding through effective grouping.
Module 6: Release Strategies and Change Management
- Implement canary releases with automated traffic shifting based on error rate and latency thresholds.
- Decide whether feature flags should be short-lived (for releases) or long-lived (for permissions or experiments).
- Enforce change advisory board (CAB) review for high-risk deployments, with automated checklist validation.
- Use dark launching to validate new systems with production traffic without exposing functionality.
- Track deployment frequency and rollback rates to measure team-level release safety and confidence.
- Coordinate blue-green deployments with DNS and load balancer reconfiguration in multi-region setups.
Module 7: Security and Compliance Integration
- Integrate SAST tools into pull request pipelines with defined false positive triage procedures.
- Scan container images for CVEs at build time and enforce severity-based blocking policies.
- Automate compliance checks for regulatory controls (e.g., PCI, HIPAA) using InSpec or OpenSCAP.
- Implement just-in-time access for production environments using identity brokers like Teleport or HashiCorp Boundary.
- Enforce least privilege in CI/CD by scoping service account permissions to specific namespaces and actions.
- Generate audit trails for configuration changes using cloud logging APIs and export to SIEM systems.
Module 8: Scaling DevOps Practices Across Enterprise Units
- Develop internal developer platforms (IDPs) using Backstage to standardize tooling and reduce cognitive load.
- Define platform service level objectives (SLOs) for shared services like logging and CI runners.
- Implement chargeback or showback models to increase cost awareness across teams.
- Orchestrate multi-team deployments using dependency graphs and coordinated release trains.
- Standardize API contracts and deprecation policies across service boundaries.
- Measure platform adoption through self-service task completion rates and support ticket volume trends.