平台工程实践：构建 Internal Developer Platform

# backstage-deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: backstage
  namespace: platform
spec:
  replicas: 2
  selector:
    matchLabels:
      app: backstage
  template:
    metadata:
      labels:
        app: backstage
    spec:
      containers:
        - name: backstage
          image: registry.example.com/backstage:1.24.0
          ports:
            - containerPort: 7007
          env:
            - name: POSTGRES_HOST
              valueFrom:
                secretKeyRef:
                  name: backstage-secrets
                  key: postgres-host
            - name: POSTGRES_USER
              valueFrom:
                secretKeyRef:
                  name: backstage-secrets
                  key: postgres-user
            - name: POSTGRES_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: backstage-secrets
                  key: postgres-password
          resources:
            requests:
              memory: "512Mi"
              cpu: "250m"
            limits:
              memory: "1Gi"
              cpu: "500m"
          readinessProbe:
            httpGet:
              path: /healthcheck
              port: 7007
            initialDelaySeconds: 30
            periodSeconds: 10

app:
  title: 内部开发者门户
  baseUrl: https://backstage.internal.example.com

backend:
  baseUrl: https://backstage.internal.example.com
  listen:
    port: 7007
  database:
    client: pg
    connection:
      host: ${POSTGRES_HOST}
      port: 5432
      user: ${POSTGRES_USER}
      password: ${POSTGRES_PASSWORD}
      database: backstage_plugin_catalog

# 集成 GitHub/GitLab
integrations:
  github:
    - host: github.com
      token: ${GITHUB_TOKEN}

# 服务目录发现规则
catalog:
  rules:
    - allow: [Component, API, Group, User, Resource, System, Domain]
  locations:
    # 自动扫描所有含 catalog-info.yaml 的仓库
    - type: github-discovery
      target: https://github.com/your-org/*/blob/main/catalog-info.yaml
    # 组织架构
    - type: url
      target: https://github.com/your-org/backstage-catalog/blob/main/org.yaml

# 技术文档
techdocs:
  builder: external
  generator:
    runIn: docker
  publisher:
    type: awsS3
    awsS3:
      bucketName: example-techdocs
      region: us-west-2

apiVersion: backstage.io/v1alpha1
kind: Component
metadata:
  name: order-service
  title: 订单服务
  description: 处理用户订单的核心服务，包含下单、支付、状态查询
  annotations:
    github.com/project-slug: your-org/order-service
    backstage.io/techdocs-ref: dir:.
    prometheus.io/alert-dashboard: "https://grafana.internal/d/order-service"
    argocd/app-name: order-service-prod
  tags:
    - golang
    - postgresql
    - kafka
  links:
    - url: https://grafana.internal/d/order-service
      title: 监控大盘
      icon: dashboard
    - url: https://runbook.internal/order-service
      title: 故障处理手册
      icon: docs
spec:
  type: service
  lifecycle: production
  owner: team-commerce
  system: e-commerce-platform
  dependsOn:
    - component:user-service
    - component:payment-service
    - resource:orders-db
  providesApis:
    - order-api

// packages/app/src/App.tsx 关键插件引入
import { ArgoCDPage } from '@backstage-community/plugin-argocd';
import { GrafanaPage } from '@backstage-community/plugin-grafana';
import { KubernetesPage } from '@backstage/plugin-kubernetes';
import { CostInsightsPage } from '@backstage/plugin-cost-insights';
import { TechRadarPage } from '@backstage-community/plugin-tech-radar';

# base-service/values.yaml
replicaCount: 2

image:
  pullPolicy: IfNotPresent

resources:
  requests:
    cpu: 100m
    memory: 128Mi
  limits:
    cpu: 500m
    memory: 512Mi

# 默认启用 PDB，最少保留 1 个副本
podDisruptionBudget:
  enabled: true
  minAvailable: 1

# 默认 HPA 配置
autoscaling:
  enabled: true
  minReplicas: 2
  maxReplicas: 10
  targetCPUUtilizationPercentage: 70

# 标准健康检查
probes:
  readiness:
    httpGet:
      path: /healthz
      port: http
    initialDelaySeconds: 10
    periodSeconds: 5
    failureThreshold: 3
  liveness:
    httpGet:
      path: /healthz
      port: http
    initialDelaySeconds: 30
    periodSeconds: 10
    failureThreshold: 3

# 优雅关闭
lifecycle:
  preStop:
    exec:
      command: ["/bin/sh", "-c", "sleep 5"]

terminationGracePeriodSeconds: 60

# 标准安全上下文
securityContext:
  runAsNonRoot: true
  runAsUser: 1000
  readOnlyRootFilesystem: true

# Prometheus 监控
serviceMonitor:
  enabled: true
  interval: 30s
  path: /metrics

# services/order-service/values.yaml
image:
  repository: registry.example.com/order-service
  tag: "v1.2.3"

service:
  port: 8080

env:
  - name: DB_DSN
    valueFrom:
      secretKeyRef:
        name: order-service-secrets
        key: db-dsn
  - name: KAFKA_BROKERS
    value: "kafka-0.kafka:9092,kafka-1.kafka:9092"

resources:
  requests:
    memory: 256Mi
  limits:
    memory: 1Gi

autoscaling:
  maxReplicas: 20  # 订单服务流量大，放宽上限

# templates/go-service-template.yaml
apiVersion: scaffolder.backstage.io/v1beta3
kind: Template
metadata:
  name: go-microservice
  title: Go 微服务模板
  description: 创建一个包含完整工程配置的 Go 微服务
  tags:
    - golang
    - recommended
spec:
  owner: platform-team
  type: service

  parameters:
    - title: 基本信息
      required:
        - name
        - description
        - owner
      properties:
        name:
          title: 服务名称
          type: string
          description: 小写字母+连字符，例如 order-service
          pattern: '^[a-z][a-z0-9-]*$'
        description:
          title: 服务描述
          type: string
        owner:
          title: 负责团队
          type: string
          ui:field: OwnerPicker
          ui:options:
            allowedKinds: [Group]
    - title: 技术配置
      properties:
        database:
          title: 是否需要数据库
          type: string
          enum: [none, postgresql, mysql]
          default: none
        enableKafka:
          title: 是否接入 Kafka
          type: boolean
          default: false

  steps:
    - id: fetch-base
      name: 生成项目骨架
      action: fetch:template
      input:
        url: ./skeleton
        values:
          name: ${{ parameters.name }}
          description: ${{ parameters.description }}
          owner: ${{ parameters.owner }}
          database: ${{ parameters.database }}
          enableKafka: ${{ parameters.enableKafka }}

    - id: create-repo
      name: 创建 Git 仓库
      action: github:repo:create
      input:
        repoUrl: github.com?owner=your-org&repo=${{ parameters.name }}

    - id: publish
      name: 推送代码
      action: publish:github
      input:
        repoUrl: github.com?owner=your-org&repo=${{ parameters.name }}
        defaultBranch: main

    - id: create-argocd-app
      name: 注册 ArgoCD 应用
      action: argocd:create-resources
      input:
        appName: ${{ parameters.name }}-qa
        namespace: ${{ parameters.name }}
        project: default
        repoUrl: https://github.com/your-org/${{ parameters.name }}
        path: k8s/overlays/qa

  output:
    links:
      - title: 代码仓库
        url: ${{ steps['create-repo'].output.remoteUrl }}
      - title: Backstage 服务页面
        url: ${{ steps['register'].output.catalogInfoUrl }}

serviceMonitor:
  enabled: true