Skip to content

Commit a7b2e4c

Browse files
wnqueirozwnqueiroz
committed
feat(backstage): configure RBAC and Kubernetes plugin with service account token injection
- Added RBAC manifests with scoped ClusterRoles for Kubernetes and Crossplane ingestion - Enabled service account token injection into backstage-secrets via up.sh - Updated catalog locations and renamed all-templates.yaml to all.yaml - Added catalog definitions for Backstage and Postgres components - Switched container port from 8070 to 3000 and updated Dockerfile to copy catalog dir
1 parent 0d9d289 commit a7b2e4c

10 files changed

Lines changed: 177 additions & 27 deletions

File tree

‎.bootstrap/backstage/manifests/deployment.yaml‎

Lines changed: 3 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -12,10 +12,11 @@ spec:
1212
metadata:
1313
labels:
1414
app: backstage
15+
backstage.io/kubernetes-id: backstage
1516
spec:
1617
containers:
1718
- name: backstage
18-
image: backstage:1.0.0
19+
image: backstage:latest
1920
imagePullPolicy: IfNotPresent
2021
ports:
2122
- name: http
@@ -42,6 +43,7 @@ spec:
4243
metadata:
4344
labels:
4445
app: postgres
46+
backstage.io.kubernetes-id: backstage-postgres
4547
spec:
4648
containers:
4749
- name: postgres
@@ -57,11 +59,3 @@ spec:
5759
value: postgres.backstage-system
5860
- name: POSTGRES_PORT
5961
value: "5432"
60-
# volumeMounts:
61-
# - mountPath: /var/lib/postgresql/data
62-
# name: postgresdb
63-
# subPath: data
64-
# volumes:
65-
# - name: postgresdb
66-
# persistentVolumeClaim:
67-
# claimName: postgres-storage-claim

‎.bootstrap/backstage/manifests/rbac.yaml‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
apiVersion: v1
2+
kind: Namespace
3+
metadata:
4+
name: backstage-system
5+
---
6+
apiVersion: v1
7+
kind: ServiceAccount
8+
metadata:
9+
name: backstage-user
10+
namespace: backstage-system
11+
---
12+
apiVersion: v1
13+
kind: Secret
14+
metadata:
15+
name: backstage-token
16+
namespace: backstage-system
17+
annotations:
18+
kubernetes.io/service-account.name: backstage-user
19+
type: kubernetes.io/service-account-token
20+
---
21+
apiVersion: rbac.authorization.k8s.io/v1
22+
kind: ClusterRoleBinding
23+
metadata:
24+
name: backstage-kubernetes-ingestor-rbac
25+
roleRef:
26+
apiGroup: rbac.authorization.k8s.io
27+
kind: ClusterRole
28+
name: view
29+
subjects:
30+
- kind: ServiceAccount
31+
name: backstage-user
32+
namespace: backstage-system
33+
---
34+
apiVersion: rbac.authorization.k8s.io/v1
35+
kind: ClusterRole
36+
metadata:
37+
name: backstage-crd-viewer
38+
rules:
39+
- apiGroups:
40+
- apiextensions.k8s.io
41+
resources:
42+
- customresourcedefinitions
43+
verbs:
44+
- get
45+
- list
46+
- watch
47+
---
48+
apiVersion: rbac.authorization.k8s.io/v1
49+
kind: ClusterRoleBinding
50+
metadata:
51+
name: backstage-crossplane-ingestion-crd-rbac
52+
roleRef:
53+
apiGroup: rbac.authorization.k8s.io
54+
kind: ClusterRole
55+
name: backstage-crd-viewer
56+
subjects:
57+
- kind: ServiceAccount
58+
name: backstage-user
59+
namespace: backstage-system
60+
---
61+
apiVersion: rbac.authorization.k8s.io/v1
62+
kind: ClusterRoleBinding
63+
metadata:
64+
name: backstage-crossplane-ingestion-rbac
65+
roleRef:
66+
apiGroup: rbac.authorization.k8s.io
67+
kind: ClusterRole
68+
name: crossplane-view
69+
subjects:
70+
- kind: ServiceAccount
71+
name: backstage-user
72+
namespace: backstage-system

‎.bootstrap/backstage/manifests/service.yaml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,9 @@ kind: Service
33
metadata:
44
name: backstage
55
namespace: backstage-system
6+
labels:
7+
app: backstage
8+
backstage.io/kubernetes-id: backstage
69
spec:
710
selector:
811
app: backstage
@@ -16,6 +19,9 @@ kind: Service
1619
metadata:
1720
name: postgres
1821
namespace: backstage-system
22+
labels:
23+
app: postgres
24+
backstage.io/kubernetes-id: backstage-postgres
1925
spec:
2026
selector:
2127
app: postgres

‎.bootstrap/backstage/up.sh‎

Lines changed: 17 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,8 +6,8 @@ set -euo pipefail
66
NS=backstage-system
77
BASE_DIR="$(dirname "$0")"
88
MANIFESTS_DIR="$BASE_DIR/manifests"
9-
PORT=8070
10-
IMAGE="backstage:1.0.0"
9+
PORT=3000
10+
IMAGE="backstage:latest"
1111
CLUSTER_NAME="platform"
1212
CONTEXT_NAME="kind-${CLUSTER_NAME}"
1313

@@ -45,6 +45,21 @@ kind load docker-image "$IMAGE" --name "$CLUSTER_NAME"
4545
echo "Applying manifests from $MANIFESTS_DIR..."
4646
kubectl apply -f "$MANIFESTS_DIR" --recursive --namespace "$NS"
4747

48+
# Wait for the ServiceAccount Secret to be created
49+
echo "Waiting for backstage-token to be created..."
50+
until kubectl get secret -n "$NS" backstage-token >/dev/null 2>&1; do
51+
sleep 1
52+
done
53+
54+
# Injecting SERVICE_ACCOUNT_TOKEN into backstage-secrets...
55+
echo "Injecting SERVICE_ACCOUNT_TOKEN into backstage-secrets..."
56+
SERVICE_ACCOUNT_TOKEN=$(kubectl get secret -n "$NS" backstage-token -o jsonpath='{.data.token}' | base64 --decode)
57+
58+
kubectl patch secret backstage-secrets \
59+
-n "$NS" \
60+
--type='merge' \
61+
-p "{\"data\": {\"SERVICE_ACCOUNT_TOKEN\": \"$(echo -n "$SERVICE_ACCOUNT_TOKEN" | base64)\"}}"
62+
4863
# Wait for postgres deployment to be ready
4964
echo "Waiting for postgres deployment to be ready..."
5065
kubectl rollout status deployment/postgres -n "$NS" --timeout=120s || {

‎Makefile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ up: check_bins
2424

2525
@echo
2626
@echo "---------------------------------------------------------------------------------------------------------------------------"
27-
@echo "Backstage is accessible at http://localhost:8070"
27+
@echo "Backstage is accessible at http://localhost:3000"
2828
@echo "Argo CD is accessible at http://localhost:8080"
2929
@echo "Komoplane is accessible at http://localhost:8090"
3030
@echo "LocalStack is accessible at http://localhost:4566 (Manage through the platform at: https://app.localstack.cloud/instances)"

‎backstage/app-config.production.yaml‎

Lines changed: 16 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -57,9 +57,22 @@ catalog:
5757
locations:
5858
# All Templates
5959
- type: url
60-
target: https://github.com/wnqueiroz/platform-engineering-backstack/blob/main/backstage/catalog/all-templates.yaml
61-
rules:
62-
- allow: [Template]
60+
target: https://github.com/wnqueiroz/platform-engineering-backstack/blob/main/backstage/catalog/all.yaml
61+
6362
# Experimental: Always use the search method in UrlReaderProcessor.
6463
# New adopters are encouraged to enable it as this behavior will be the default in a future release.
6564
useUrlReadersSearch: true
65+
66+
kubernetes:
67+
# see https://backstage.io/docs/features/kubernetes/configuration for kubernetes configuration options
68+
serviceLocatorMethod:
69+
type: 'multiTenant'
70+
clusterLocatorMethods:
71+
- type: 'config'
72+
clusters:
73+
- url: https://kubernetes.default.svc
74+
name: kind
75+
authProvider: 'serviceAccount'
76+
skipTLSVerify: true
77+
skipMetricsLookup: true
78+
serviceAccountToken: ${SERVICE_ACCOUNT_TOKEN}

‎backstage/app-config.yaml‎

Lines changed: 20 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -80,25 +80,23 @@ catalog:
8080
locations:
8181
# All Templates
8282
- type: url
83-
target: https://github.com/wnqueiroz/platform-engineering-backstack/blob/main/backstage/catalog/all-templates.yaml
84-
rules:
85-
- allow: [Template]
83+
target: https://github.com/wnqueiroz/platform-engineering-backstack/blob/main/backstage/catalog/all.yaml
8684

8785
# Local example data, file locations are relative to the backend process, typically `packages/backend`
88-
# - type: file
89-
# target: ../../examples/entities.yaml
86+
- type: file
87+
target: ../../catalog/components.yaml
9088

9189
# # Local example template
9290
# - type: file
9391
# target: ../../examples/template/template.yaml
9492
# rules:
9593
# - allow: [Template]
9694

97-
# # Local example organizational data
98-
# - type: file
99-
# target: ../../examples/org.yaml
100-
# rules:
101-
# - allow: [User, Group]
95+
# Local example organizational data
96+
- type: file
97+
target: ../../examples/org.yaml
98+
rules:
99+
- allow: [User, Group]
102100

103101
## Uncomment these lines to add more example data
104102
# - type: url
@@ -115,8 +113,20 @@ catalog:
115113

116114
kubernetes:
117115
# see https://backstage.io/docs/features/kubernetes/configuration for kubernetes configuration options
116+
serviceLocatorMethod:
117+
type: 'multiTenant'
118+
clusterLocatorMethods:
119+
- type: 'config'
120+
clusters:
121+
- url: https://127.0.0.1:52484
122+
name: kind
123+
authProvider: 'serviceAccount'
124+
skipTLSVerify: true
125+
skipMetricsLookup: true
126+
serviceAccountToken: ${SERVICE_ACCOUNT_TOKEN}
118127

119128
# see https://backstage.io/docs/permissions/getting-started for more on the permission framework
120129
permission:
121130
# setting this to `false` will disable permissions
122131
enabled: true
132+
# TODO: configurar a ingestão de Claims do Crossplane

backstage/catalog/all-templates.yaml renamed to backstage/catalog/all.yaml

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,11 @@
11
apiVersion: backstage.io/v1alpha1
22
kind: Location
33
metadata:
4-
name: all-templates
5-
title: 'All Templates'
4+
name: all
5+
title: 'All'
66
spec:
77
type: url
88
targets:
99
- ./templates/xqueue-claim/template.yaml
10+
- ./components.yaml
11+
- ../examples/org.yaml

‎backstage/catalog/components.yaml‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
apiVersion: backstage.io/v1alpha1
2+
kind: System
3+
metadata:
4+
name: backstage
5+
description: Represents the Backstage developer portal ecosystem
6+
spec:
7+
owner: guests
8+
---
9+
apiVersion: backstage.io/v1alpha1
10+
kind: Component
11+
metadata:
12+
name: backstage
13+
description: Backstage is an internal developer portal that centralizes software components, documentation, and tools to streamline developer workflows.
14+
annotations:
15+
backstage.io/kubernetes-id: backstage
16+
links:
17+
- url: http://localhost:3000
18+
title: Backstage UI
19+
icon: dashboard
20+
spec:
21+
type: service
22+
lifecycle: production
23+
owner: guests
24+
system: backstage
25+
---
26+
apiVersion: backstage.io/v1alpha1
27+
kind: Component
28+
metadata:
29+
name: backstage-postgres
30+
description: PostgreSQL database instance used to persist Backstage metadata and catalog information.
31+
annotations:
32+
backstage.io/kubernetes-id: backstage-postgres
33+
spec:
34+
type: service
35+
lifecycle: production
36+
owner: guests
37+
system: backstage

‎backstage/packages/backend/Dockerfile‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -62,6 +62,7 @@ RUN --mount=type=cache,target=/home/node/.cache/yarn,sharing=locked,uid=1000,gid
6262

6363
# This will include the examples, if you don't need these simply remove this line
6464
COPY --chown=node:node examples ./examples
65+
COPY --chown=node:node catalog ./catalog
6566

6667
# Then copy the rest of the backend bundle, along with any other files we might want.
6768
COPY --chown=node:node packages/backend/dist/bundle.tar.gz app-config*.yaml ./

0 commit comments

Comments
 (0)