The Platform Engineering Handbook

Platform engineering has moved from niche practice to mainstream organisational priority - but most teams are building their platforms without a map. They adopt Kubernetes without a multi-tenancy strategy, implement GitOps without solving secrets management first, and launch a developer portal that nobody trusts within six months because nobody owns the catalogue. The Platform Engineering Playbook exists to fix that.

Written for intermediate to senior software engineers, DevOps engineers, and engineering managers, this book covers the complete lifecycle of an Internal Developer Platform - from the foundational architecture decisions that constrain everything downstream, through the developer experience layer that determines whether engineers adopt the platform voluntarily, to the security, compliance, and FinOps practices that keep a shared platform governable at scale.

Inside, you will find practical, honest guidance on every major platform engineering concern:

• Kubernetes operators, CRDs, and GitOps with ArgoCD and Flux - including where GitOps breaks down and how to handle it
• Secrets management with Vault, External Secrets Operator, and Sealed Secrets - positioned where it belongs, before you build anything else
• Infrastructure as Code with Terraform, OpenTofu, and Pulumi - including the shared-state anti-patterns that create blast radius across teams
• Service mesh trade-offs across Istio, Linkerd, and Cilium - with an honest accounting of the operational cost each introduces
• Developer portals built on Backstage - including the resourcing reality that most guides omit
• Golden paths, scaffolding templates, and progressive delivery with Argo Rollouts
• Software supply chain security with SLSA, SBOMs, and Sigstore
• Policy as code with OPA and Kyverno, zero trust networking, and compliance automation for SOC 2 and ISO 27001
• Platform SLOs, error budgets, FinOps with Kubecost, and the multi-cloud trade-off analysis most organisations never do rigorously
• Platform incident response - the runbooks for when the platform itself is the incident
• API versioning and breaking change management at scale
• Building, staffing, and evangelising the platform team, including the product manager problem nobody talks about

Every chapter acknowledges the realistic costs and failure modes of the approaches it describes. This is not a vendor brochure or a Kubernetes beginner tutorial. It is a practitioner's guide written for engineers who will be making real decisions with real consequences.