| name | caf-platform-automation-devops |
| description | CAF/ALZ guidance for the Platform automation and DevOps design area: infrastructure as code for the platform, the bootstrap/management of the deployment toolchain, CI/CD pipelines and Git workflow, identities for automation (managed identities, OIDC/workload identity federation), environments/promotion, and keeping the landing zone up to date. WHEN: "platform automation", "devops design area", "infrastructure as code", "IaC strategy", "ci/cd pipeline", "github actions", "azure devops pipelines", "gitops", "deployment identity", "workload identity federation", "OIDC to azure", "keep alz up to date", "drift", "promote environments", "bootstrap automation". DO NOT USE FOR: choosing between Bicep and Terraform accelerators or actual deployment steps (use the alz-accelerator skill); policy-as-code authoring (use caf-governance); deploying a specific app workload to Azure (use the azure-deploy skill). |
| license | MIT |
| metadata | {"author":"Jan Egil Ring","version":"0.1.0","designArea":"Platform automation and DevOps"} |
Platform automation and DevOps
Overview
This design area makes the platform repeatable and maintainable: the landing zone is defined as
infrastructure as code, deployed through CI/CD pipelines with secure, secretless automation
identities, and kept up to date as Azure and the ALZ reference implementations evolve. It is
IaC-agnostic at the design level — the practice (Git workflow, environments, identities, drift
control) matters more than the specific tool; tool-specific steps live in the alz-accelerator
skill.
When to use this skill
- Defining the IaC strategy and repository/branching model for the platform.
- Designing CI/CD pipelines (GitHub Actions or Azure DevOps) to deploy and update ALZ.
- Setting up automation identities with managed identity / workload identity federation
(OIDC) instead of long-lived secrets.
- Planning environments and promotion (e.g. canary/management-group rings) and drift control.
- Establishing a process to keep the landing zone current with upstream module/policy updates.
Key concepts
- Platform as code — the management groups, policies, networking, and baselines are defined in
source control, reviewed, and deployed via pipelines — not click-ops.
- Bootstrap — the one-time setup of the deployment toolchain (repos, pipelines, service
connections, deployment identity) before the platform itself is deployed.
- Workload identity federation (OIDC) — pipelines authenticate to Azure with short-lived,
federated tokens; no stored secrets to rotate or leak.
- Environments / promotion — change flows through stages (plan → review → apply), often using
management-group rings to limit blast radius.
- Drift and updates — detect configuration drift and consume upstream improvements (modules,
AVM, default policies) on a maintained cadence (keep ALZ up to date).
Decision guidance
IaC and repository design
- Treat the platform as a versioned product: one source of truth, reviewed pull requests,
tagged releases. Separate platform from workload pipelines.
- Pick the IaC tool that matches team skills and the chosen accelerator (Bicep or Terraform) — keep
the practice consistent regardless (see
alz-accelerator for specifics).
Pipelines and identities
- Use OIDC / workload identity federation for pipeline-to-Azure auth; avoid stored service
principal secrets entirely.
- Scope deployment identities with least privilege at the management-group level needed, not
tenant-wide Owner.
- Gate production applies with approvals and run plan/what-if before apply.
Keeping ALZ current
- Subscribe to upstream releases and adopt updates on a regular cadence; run drift detection so
manual changes are caught and reconciled.
- Promote changes through environment rings to validate before broad rollout.
Recommended resources
Related skills and agents
- Skill:
alz-accelerator — the Bicep/Terraform toolchains this practice drives.
- Skill:
caf-governance — policy as code deployed through these pipelines.
- Skill:
caf-management — operational baselines kept current via automation.
- Skill:
caf-identity-access-management — identities and least-privilege for automation.
- Agent:
alz-accelerator-expert — bootstrap and module deployment workflows.
