{"slug":"platform-engineering-backstage-crossplane","title":"Platform Engineering: Building Internal Developer Platforms with Backstage and Crossplane","description":"How to build a self-service developer platform that reduces environment provisioning from weeks to minutes using Backstage, Crossplane, and ArgoCD","date":"2025-02-15","author":"Elaph Hilful","thumbnail":"/blog-images/platform-engineering.svg","tags":["Platform Engineering","Backstage","Crossplane","ArgoCD","Kubernetes"],"category":"DevOps","featured":true,"readTime":6,"htmlContent":"

Platform Engineering has emerged as the answer to a critical question: how do you enable 200+ engineers to provision production-ready environments without creating a bottleneck on your infrastructure team? The answer is an Internal Developer Platform (IDP) that provides self-service infrastructure with built-in guardrails.

\n

In this guide, I'll share how we built a platform that reduced environment provisioning from 2-3 weeks to under 10 minutes while maintaining SOC 2 compliance.

\n

\"Internal

\n

Why Platform Engineering?

\n

The DevOps promise was \"you build it, you run it.\" The reality? Most developers don't want to be infrastructure experts — they want to ship features. Platform Engineering bridges this gap by providing:

\n\n

The Architecture: Three Layers

\n

Layer 1: Developer Experience (Backstage)

\n

Backstage is the frontend of your platform. It provides a unified portal where developers can:

\n\n
# backstage/templates/microservice/template.yaml\napiVersion: scaffolder.backstage.io/v1beta3\nkind: Template\nmetadata:\n  name: production-microservice\n  title: Production Microservice\n  description: Create a new microservice with CI/CD, observability, and security\nspec:\n  owner: platform-team\n  type: service\n\n  parameters:\n    - title: Service Details\n      required: [name, team, language]\n      properties:\n        name:\n          title: Service Name\n          type: string\n          pattern: \"^[a-z][a-z0-9-]*$\"\n        team:\n          title: Owning Team\n          type: string\n          enum: [payments, identity, commerce, data]\n        language:\n          title: Language\n          type: string\n          enum: [go, typescript, python, java]\n        tier:\n          title: Service Tier\n          type: string\n          enum: [critical, standard, experimental]\n          default: standard\n\n    - title: Infrastructure\n      properties:\n        cloud:\n          title: Cloud Provider\n          type: string\n          enum: [aws, azure, gcp]\n          default: aws\n        database:\n          title: Database\n          type: string\n          enum: [postgres, mysql, dynamodb, none]\n        cache:\n          title: Cache Layer\n          type: string\n          enum: [redis, memcached, none]\n\n  steps:\n    - id: scaffold\n      name: Scaffold Repository\n      action: fetch:template\n      input:\n        url: ./skeleton\n        values:\n          name: ${{ parameters.name }}\n          team: ${{ parameters.team }}\n\n    - id: publish\n      name: Create Repository\n      action: publish:github\n      input:\n        repoUrl: github.com?owner=myorg&repo=${{ parameters.name }}\n\n    - id: provision-infra\n      name: Provision Infrastructure\n      action: crossplane:claim\n      input:\n        apiVersion: platform.myorg.io/v1alpha1\n        kind: Environment\n        metadata:\n          name: ${{ parameters.name }}\n        spec:\n          cloud: ${{ parameters.cloud }}\n          tier: ${{ parameters.tier }}\n          database: ${{ parameters.database }}\n          cache: ${{ parameters.cache }}\n\n    - id: register\n      name: Register in Catalog\n      action: catalog:register\n      input:\n        repoContentsUrl: ${{ steps.publish.output.repoContentsUrl }}\n        catalogInfoPath: /catalog-info.yaml\n
\n

Layer 2: GitOps Orchestration (ArgoCD)

\n

ArgoCD ensures that the desired state in Git matches the actual state in the cluster. Every infrastructure change flows through Git:

\n
# argocd/application-set.yaml\napiVersion: argoproj.io/v1alpha1\nkind: ApplicationSet\nmetadata:\n  name: team-environments\n  namespace: argocd\nspec:\n  generators:\n    - git:\n        repoURL: https://github.com/myorg/environments.git\n        revision: HEAD\n        directories:\n          - path: teams/*/environments/*\n\n  template:\n    metadata:\n      name: \"{{path.basename}}\"\n      labels:\n        team: \"{{path[1]}}\"\n        environment: \"{{path[3]}}\"\n    spec:\n      project: \"{{path[1]}}\"\n      source:\n        repoURL: https://github.com/myorg/environments.git\n        targetRevision: HEAD\n        path: \"{{path}}\"\n      destination:\n        server: https://kubernetes.default.svc\n        namespace: \"{{path[1]}}-{{path[3]}}\"\n      syncPolicy:\n        automated:\n          prune: true\n          selfHeal: true\n        syncOptions:\n          - CreateNamespace=true\n          - ServerSideApply=true\n
\n

Layer 3: Infrastructure Abstraction (Crossplane)

\n

Crossplane is the secret weapon. It exposes cloud infrastructure as Kubernetes-native APIs, letting developers provision databases, caches, and queues with simple YAML:

\n
# crossplane/compositions/environment.yaml\napiVersion: apiextensions.crossplane.io/v1\nkind: Composition\nmetadata:\n  name: production-environment\nspec:\n  compositeTypeRef:\n    apiVersion: platform.myorg.io/v1alpha1\n    kind: Environment\n  resources:\n    # Kubernetes Namespace\n    - name: namespace\n      base:\n        apiVersion: kubernetes.crossplane.io/v1alpha1\n        kind: Object\n        spec:\n          forProvider:\n            manifest:\n              apiVersion: v1\n              kind: Namespace\n      patches:\n        - fromFieldPath: metadata.name\n          toFieldPath: spec.forProvider.manifest.metadata.name\n\n    # PostgreSQL Database (if requested)\n    - name: database\n      base:\n        apiVersion: rds.aws.upbound.io/v1beta1\n        kind: Instance\n        spec:\n          forProvider:\n            engine: postgres\n            engineVersion: \"15\"\n            instanceClass: db.t3.medium\n            allocatedStorage: 20\n            publiclyAccessible: false\n            storageEncrypted: true\n      patches:\n        - fromFieldPath: spec.tier\n          toFieldPath: spec.forProvider.instanceClass\n          transforms:\n            - type: map\n              map:\n                critical: db.r6g.xlarge\n                standard: db.t3.medium\n                experimental: db.t3.micro\n\n    # Redis Cache (if requested)\n    - name: cache\n      base:\n        apiVersion: elasticache.aws.upbound.io/v1beta1\n        kind: ReplicationGroup\n        spec:\n          forProvider:\n            engine: redis\n            engineVersion: \"7.0\"\n            nodeType: cache.t3.medium\n            numCacheClusters: 2\n            atRestEncryptionEnabled: true\n            transitEncryptionEnabled: true\n
\n

Developer Workflow: From Request to Running Service

\n

Here's what the developer experience looks like:

\n
    \n
  1. Developer opens Backstage, selects \"Create New Service\"
    2. \n
  2. Backstage scaffolds repository from golden path template
    3. \n
  3. Git commit triggers ArgoCD sync
    4. \n
  4. ArgoCD deploys Crossplane Claims to the cluster
    5. \n
  5. Crossplane provisions cloud resources (RDS, ElastiCache, etc.)
    6. \n
  6. Service is running with CI/CD, monitoring, and security — in under 10 minutes
    7. \n
\n
# What developers see:\n$ kubectl get environments -n payments-team\nNAME              CLOUD   TIER       STATUS   AGE\ncheckout-service  aws     critical   Ready    8m\nfraud-detector    aws     standard   Ready    6m\n
\n

Policy Guardrails: Security Without Friction

\n

The platform enforces organizational policies automatically:

\n
# crossplane/compositions/policy-hooks.yaml\n# Cost guardrails per tier\n- fromFieldPath: spec.tier\n  toFieldPath: metadata.annotations[cost-limit]\n  transforms:\n    - type: map\n      map:\n        critical: \"5000\" # $5000/month max\n        standard: \"1000\" # $1000/month max\n        experimental: \"100\" # $100/month max\n
\n

Combined with OPA Gatekeeper:

\n
# Prevent experimental workloads in production clusters\ndeny[msg] {\n    input.review.object.metadata.labels.tier == \"experimental\"\n    input.review.object.metadata.namespace == \"production\"\n    msg := \"Experimental tier workloads cannot be deployed to production\"\n}\n
\n

Results: Measurable Impact

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
MetricBefore IDPAfter IDP
Environment provisioning2-3 weeks< 10 minutes
Infrastructure tickets/month200+< 30
Teams fully self-serving040+
Compliance violationsFrequentZero (automated)
Platform uptime99.9%99.99%
Annual cost savings-$420K (right-sizing)
\n

Lessons from Production

\n
    \n
  1. \n

    Start with golden paths, not golden cages: Give teams escape hatches for genuinely unique needs, but make the golden path so good that 90% of teams choose it voluntarily.

    \n
    2. \n
  2. \n

    Treat your platform as a product: Your engineers are your customers. Measure developer satisfaction, gather feedback, and iterate. If the platform is harder than doing things manually, teams will route around it.

    \n
    3. \n
  3. \n

    Composability over completeness: Don't try to build everything at once. Start with the most common provisioning patterns and expand based on demand.

    \n
    4. \n
  4. \n

    GitOps makes everything auditable: Every infrastructure change has a PR, a review, and a commit hash. This makes compliance evidence automatic.

    \n
    5. \n
  5. \n

    Invest in documentation: A platform without documentation is a black box. Backstage's TechDocs integration makes documentation a first-class citizen.

    \n
    6. \n
\n

Getting Started

\n

The quickest path to an IDP:

\n
    \n
  1. Month 1: Deploy Backstage with a service catalog (just visibility)
    2. \n
  2. Month 2: Add 2-3 golden path templates for common patterns
    3. \n
  3. Month 3: Integrate Crossplane for infrastructure provisioning
    4. \n
  4. Month 4: Add ArgoCD for GitOps-driven deployments
    5. \n
  5. Month 5+: Iterate based on developer feedback
    6. \n
\n

Remember: the best platform is one that engineers actually want to use. Start simple, prove value, and expand.

"}