Nordlicht Reisen GmbH, a fictional travel agency, wants a DevOps platform for its booking portal. So far, one employee builds the application on his own machine, copies it to the server and reports it by email. You are to design how work, source code, delivery, security and measurement work together in the future, and implement the essentials on a test account. The project is a design task with implementation: First you put decisions with reasons in writing, then you build the sketch.
Prior knowledge: The project connects all areas of the exam: lessons 1.1 to 6.2 of this course and, from K3, the .NET application with its first pipeline (K3, lesson 3.7.2). None of that is explained again here; every decision names the lesson that supplies its knowledge.
- Exercise 1 is the design: a document with requirements, decisions and reasons. It needs no account.
- Exercise 2 implements an excerpt on test accounts: a repository with protection rules, an identity without a secret, a pipeline with environments and blue-green delivery, an alert and the way back.
The starting point
Nordlicht Reisen has eight developers, one product manager and two people in operations. The booking portal is an ASP.NET Core application with a database. The business department plans in Azure Boards and wants to keep doing so; the code is to live on GitHub; delivery goes to an Azure Container App.
| No. | Requirement | Exam area |
|---|---|---|
| A1 | Every change can be traced back to a work item; the product manager sees the status without asking. | Processes and communication |
| A2 | Nobody writes directly to main; every change is read by a second person. |
Source control |
| A3 | Every delivered version can be traced back to a commit. | Packages and versions |
| A4 | Building and testing run automatically on every pull request. | Pipelines |
| A5 | Production is reached only after approval by the product manager and is switched over without downtime. | Pipelines |
| A6 | If a version goes wrong, the way back is one step, not a rebuild. | Pipelines |
| A7 | No pipeline holds a password or key for Azure. | Security and compliance |
| A8 | Every person and every automation has only the permissions the task needs. | Security and compliance |
| A9 | Outdated packages, vulnerabilities in the code and checked-in secrets are found before production; high findings block. | Security and compliance |
| A10 | If the delivery chain stalls, someone who can act learns about it. | Instrumentation |
The table is the yardstick: Every decision satisfies at least one requirement, and every requirement needs at least one decision.