🛤️ शाळेच्या पद्धतीने platform engineering शिका

# the 60-second wow — the facilities office, in your terminal:
git clone https://github.com/BaluRaut/learn-platform-engineering-school.git && cd learn-platform-engineering-school
python3 idp/demo.py                # 12 lessons: tickets, templates, quotas, previews, guardrails, DORA
python3 idp/test_idp.py            # 12 checks across the lessons

तुम्हाला काय दिसायला हवे (छाटलेले — यश असे दिसते):

═══ why ═══
── to open one classroom (ship one service) a teacher's team must handle 14 concerns alone
   with the facilities office: the team keeps 4 (application code, tests, alerts, on-call for the service)
   the office offers 10 as ready kits (Dockerfile, CI pipeline, Terraform, IAM, DNS + TLS …) — still visible, still changeable
── the ticket queue: 5 requests a day, the office finishes 4 a day, for 20 working days
   finished 80 · still waiting 20 · average wait 2.0 days
   a ticket finished on day 1 waited 0 days · one finished on day 20 waited 4 days — the line grows by 1 every day
   'you build it, you run it' stays — the office removes the undifferentiated work, not the ownership

═══ product ═══
── Dipika (the facilities office) interviews 5 departments: hours lost per week, per pain
   1. waiting for a database     15 h/week across 3 teams
   2. writing CI YAML             7 h/week across 2 teams
   3. finding a service's owner   5 h/week across 4 teams
   4. preview environments        5 h/week across 2 teams
   5. rotating secrets            3 h/week across 2 teams
── the roadmap starts at the top: self-service databases first, not the tool the office finds most fun
   month 1:  20% of departments chose the paved path
   month 3:  60% of departments chose the paved path
   month 6:  80% of departments chose the paved path
   adoption is earned, not mandated: if a team leaves the path, ask why — it is product feedback

═══ goldenpath ═══
── create ('python-service', 'Exam Results!', 'science') → refused:
   • name 'Exam Results!' — use 3–31 lowercase letters, digits or dashes, starting with a letter, e.g. 'exam-results'
── create ('python-service', 'timetable', 'sciense') → refused:
   • name 'timetable' is taken — pick another, or ask its owner in the catalog
   • owner 'sciense' is not a known group — choose one of: facilities-office, library, maths, science
── create ('java-service', 'exam-results', 'science') → refused:
   • no template 'java-service' — choose one of: python-service, static-site
── Katrina creates 'exam-results' from python-service v3 → 8 files, ready to push:
   README.md
   src/app.py
   tests/test_app.py
   Dockerfile
   catalog-info.yaml
   .github/workflows/ci.yml
   deploy/values.yaml
   docs/index.md
   catalog-info.yaml:
     apiVersion: backstage.io/v1alpha1
     kind: Component
     metadata:
       name: exam-results
     spec:
       type: service
       lifecycle: experimental
       owner: science
   a golden path is the easy way, not the only way — teams may leave it, and then they own what they change

═══ catalog ═══
── the catalog holds 8 entries owned by groups ['science', 'maths', 'library', 'facilities-office']
   science            owns ['exam-results', 'results-db']
   maths              owns ['parent-portal', 'timetable']
   facilities-office  owns ['auth']
   orphans (no owner, or the owner group is gone): ['canteen-orders', 'fees']
   broken references: [('fees', 'payments-api'), ('library-search', 'search-index')]
── blast radius — if auth breaks, these depend on it: ['canteen-orders', 'exam-results', 'fees', 'parent-portal', 'timetable']
   if results-db breaks: ['exam-results', 'parent-portal']
   the catalog is only as good as its freshness: keep catalog-info.yaml in each repo, next to the code

═══ selfservice ═══
── science's quota: 2 databases, 3 buckets, 2 queues, 6 CPU — requests go to the office's catalogue, not a ticket
   postgres-medium results-db    → ready: science-results-db {'owner': 'science', 'managed-by': 'facilities-office'}
   postgres-small  lab-db        → ready: science-lab-db {'owner': 'science', 'managed-by': 'facilities-office'}
   postgres-small  extra-db      → refused: science already uses 2/2 databases — delete one or ask for a bigger quota
   mongodb         notes-db      → refused: 'mongodb' is not in the catalogue — offered: postgres-small, postgres-medium, bucket, queue (or ask the office to add it)
   bucket          lab-photos    → ready: science-lab-photos {'owner': 'science', 'managed-by': 'facilities-office'}
   queue           grade-events  → ready: science-grade-events {'owner': 'science', 'managed-by': 'facilities-office'}
   used now: {'databases': 2, 'buckets': 1, 'queues': 1, 'cpu': 6}
   quotas + a fixed menu make self-service safe; every refusal says what to do next

═══ previews ═══
── one preview environment per pull request · TTL 48 h (restarts on push) · at most 3 live
   h1    pr-101 created → pr-101.preview.school.test
   h5    pr-102 created → pr-102.preview.school.test
   h10   pr-103 created → pr-103.preview.school.test
   h20   pr-101 deleted (PR closed)
   h30   pr-104 created → pr-104.preview.school.test
   h40   pr-103 updated, TTL restarts
   h41   pr-105 refused — 3 previews already live; retry when one closes
   h53   pr-102 expired (TTL 48 h)
   h70   pr-103 deleted (PR closed)
   h78   pr-104 expired (TTL 48 h)
   h120  pr-106 created → pr-106.preview.school.test
   h168  pr-106 expired (TTL 48 h)
── after one week (168 h): 5 previews made · 223 environment-hours with cleanup · 674 if nobody ever deleted them
   still live at the end: [] · abandoned PRs cost nothing after their TTL

═══ pipelines ═══
── the office publishes pipeline templates v1.0.0, v2.0.0 (adds SBOM + image scan), v2.1.0 (adds a dependency cache)
   exam-results    uses @v2      → runs v2.1.0                7 steps, 15 min  (scans images)
   timetable       uses @v2.0.0  → runs v2.0.0                6 steps, 17 min  (scans images)
   library-search  uses @v1      → runs v1.0.0                4 steps, 14 min
   fees            uses @copy    → runs v1.0.0 (pasted copy)  4 steps, 14 min
   '@v2' picked up v2.1.0 by itself · '@v2.0.0' waits for a deliberate bump · '@v1' has no image scan · the pasted copy never changes
   one fix in the template reaches every service that follows it — pin exact versions (or commit SHAs) where you need control

═══ secrets ═══
── secrets live in the office's store, by path; a team reads its own paths only
   science reads teams/science/results-db-password → ok · teams/science/results-db-password v1 (22 characters, value hidden)
   science reads teams/maths/timetable-api-key     → denied · science may read teams/science/* only — ask the owner of teams/maths/timetable-api-key to share it
── rotation: the password is now v2; consumers still on the old version: ['exam-results', 'lab-worker']
   exam-results reloads → still stale: ['lab-worker'] · keep v1 valid until nobody uses it, then revoke
── config in layers (defaults → environment → service), each value explains where it came from:
   log_level           = info  (from defaults)
   replicas            = 3     (from production)
   feature_new_grades  = True  (from exam-results)

═══ policy ═══
── audit mode: exam-results → allowed with warnings (4 findings)
── enforce mode: exam-results → denied (4 findings)
   ✗ owner-label           no owner label → fix: add labels.owner: <your group> (the catalog uses it to page the right people)
   ✗ no-latest-tag         image tag is 'latest' or missing → fix: pin a version such as :1.4.2 (the paved pipeline tags every build)
   ✗ limits-set            no CPU/memory limits → fix: add limits: {cpu: 500m, memory: 256Mi} (the template's defaults)
   ✗ two-replicas-in-prod  1 replica in production → fix: set replicas: 2 or more so one restart is not an outage
── after the four fixes → allowed
   a guardrail that says 'no' and 'here is how' teaches; one that only says 'no' sends people around it

═══ scorecards ═══
── production readiness: 8 weighted checks (total weight 12) · gold ≥ 90 · silver ≥ 70 · bronze ≥ 50
   exam-results     92% gold      next: SLO written
   timetable        83% silver    next: has a runbook
   library-search   58% bronze    next: on-call rota set
   fees             50% bronze    next: has an owner
   canteen-orders   33% not ready next: has an owner
   a scorecard is a to-do list for a team, not a league table to shame them

═══ measure ═══
── the four DORA keys for the science department, 4 weeks each (teaching data):
   before (tickets)     1.0 deploys/week · lead time 150.0 h · change failure rate 50% · recovery 23.0 h
   after (paved path)   3.0 deploys/week · lead time   5.0 h · change failure rate  8% · recovery 2.0 h
── time to first deploy for a new team: 4 tickets in a row (repo, pipeline, database, DNS) × 2.0 days ≈ 8.0 days
   on the golden path: scaffold + self-service database + one pipeline run of 15 min — the same day
── weaponize the metric ('deploy more!'): count every re-run of the deploy job → 9.0 deploys/week, lead time 5.0 h
   the number tripled; the same 12 changes reached the students — nothing real improved (Goodhart's law)
   SPACE: Satisfaction, Performance, Activity, Communication, Efficiency — mix numbers with asking people; compare a team with itself

═══ portal ═══
── the portal page for exam-results (one place, gathered from every part of the office):
   owner science · lifecycle production · depends on results-db, auth
   depended on by parent-portal
   scorecard 92% (gold) · next: SLO written
   policy: allowed with warnings · bucket is public → set public_bucket: false and serve files through the CDN kit
   pipeline v2 → v2.1.0 · preview environments live: 1
   DORA: 3.0 deploys/week · lead time 5.0 h · failure rate 8% · recovery 2.0 h
── the whole picture: pains → a product roadmap → golden paths → a catalog → self-service → previews → paved pipelines
   → secrets as a service → guardrails that explain → scorecards → honest measures → one portal

✅ done — every teacher has a classroom

🗺️ संपूर्ण चित्र — एक आकृती, पूर्ण कोर्स

संपूर्ण कोर्स एका कॅनव्हासवर. 4K आवृत्तीसाठी क्लिक करा.

🧭 भाग 1 — का आणि काय (धडे 1–4)

एक git branch = एक कल्पना; branch 04 मध्ये धडे 01–04 आहेत. idp/ प्रत्येक वेळी चालवल्यावर तेच आकडे छापते.

🧰 भाग 2 — self-service (धडे 5–8)

teams स्वतःची मदत स्वतः करतात: quotas मधले resources, आपोआप साफ होणारी environments, सामायिक pipelines, rotation असलेली secrets.

🛡️ भाग 3 — संरक्षक नियम आणि मोजमाप (धडे 9–12)

'नाही' ची भिंत न उभारता self-service सुरक्षित ठेवणे, आणि कार्यालयाचा उपयोग होतोय का हे प्रामाणिकपणे दाखवणे.

📐 धड्यांच्या आकृत्या — क्रमांक अनुसरा

प्रत्येक धडा एका क्रमांकित बॉक्स-आणि-बाण आकृतीत — स्वतंत्र पानावरही.