实践案例：企业级持续交付平台构建

# app-config.yaml — Backstage 核心配置
app:
  title: Engineering Platform
  baseUrl: https://portal.example.com
 
organization:
  name: Example Corp
 
catalog:
  rules:
    - allow: [Component, System, API, Resource, Location, Template]
  locations:
    # 组织定义
    - type: url
      target: https://github.com/platform/org-catalog/blob/main/catalog-info.yaml
      rules:
        - allow: [User, Group]
 
    # 模板定义
    - type: url
      target: https://github.com/platform/templates/blob/main/template-index.yaml
      rules:
        - allow: [Template]
 
    # 自动发现所有服务的 catalog-info.yaml
    - type: url
      target: https://github.com/platform/service-catalog/blob/main/all-services.yaml
 
auth:
  environment: production
  providers:
    github:
      production:
        clientId: ${GITHUB_CLIENT_ID}
        clientSecret: ${GITHUB_CLIENT_SECRET}
 
# Kubernetes 集成
kubernetes:
  serviceLocatorMethod:
    type: multiTenant
  clusterLocatorMethods:
    - type: config
      clusters:
        - name: production
          url: https://k8s-api.example.com
          authProvider: serviceAccount
          skipTLSVerify: false
          caData: ${K8S_CA_DATA}
          serviceAccountToken: ${K8S_SA_TOKEN}
        - name: staging
          url: https://k8s-api-staging.example.com
          authProvider: serviceAccount
          caData: ${K8S_STAGING_CA_DATA}
          serviceAccountToken: ${K8S_STAGING_SA_TOKEN}
 
# ArgoCD 集成
argocd:
  appLocatorMethods:
    - type: config
      instances:
        - name: production
          url: https://argocd.example.com
          token: ${ARGOCD_TOKEN}
        - name: staging
          url: https://argocd-staging.example.com
          token: ${ARGOCD_STAGING_TOKEN}

# .github/workflows/platform-ci.yml — 平台级 CI 模板
name: Platform CI Template
 
on:
  workflow_call:
    inputs:
      service-name:
        required: true
        type: string
      language:
        required: true
        type: string
        description: "go | node | python | java"
      run-integration-tests:
        required: false
        type: boolean
        default: false
 
jobs:
  # 阶段一：代码检查
  lint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Run linter
        uses: ./.github/actions/lint
        with:
          language: ${{ inputs.language }}
 
  # 阶段二：测试
  test:
    runs-on: ubuntu-latest
    needs: lint
    steps:
      - uses: actions/checkout@v4
      - name: Run unit tests
        uses: ./.github/actions/test
        with:
          language: ${{ inputs.language }}
      - name: Run integration tests
        if: inputs.run-integration-tests
        uses: ./.github/actions/integration-test
 
  # 阶段三：安全扫描
  security:
    runs-on: ubuntu-latest
    needs: test
    steps:
      - uses: actions/checkout@v4
      - name: SAST scan
        uses: returntocorp/semgrep-action@v1
      - name: Dependency scan
        uses: anchore/sbom-action@v0
        with:
          image: ${{ inputs.service-name }}
      - name: Container scan
        uses: aquasecurity/trivy-action@master
 
  # 阶段四：构建
  build:
    runs-on: ubuntu-latest
    needs: security
    permissions:
      packages: write
    steps:
      - uses: actions/checkout@v4
      - name: Build and push container image
        uses: ./.github/actions/build
        with:
          service-name: ${{ inputs.service-name }}
          registry: ghcr.io
      - name: Sign image
        uses: sigstore/cosign-installer@v3
        run: cosign sign ghcr.io/${{ github.repository }}:${{ github.sha }}
 
  # 阶段五：部署到 Staging
  deploy-staging:
    needs: build
    runs-on: ubuntu-latest
    environment: staging
    steps:
      - name: ArgoCD sync (staging)
        run: |
          argocd app sync ${{ inputs.service-name }}-staging
          argocd app wait ${{ inputs.service-name }}-staging --health
 
  # 阶段六：部署到 Production（金丝雀）
  deploy-production:
    needs: deploy-staging
    runs-on: ubuntu-latest
    environment: production
    steps:
      - name: Argo Rollouts promote
        run: |
          kubectl argo rollouts promote ${{ inputs.service-name }} -n production

# 服务团队的 .github/workflows/ci.yml — 仅需一行
name: CI
on:
  push:
    branches: [main]
  pull_request:
 
jobs:
  ci:
    uses: platform-org/platform-workflows/.github/workflows/platform-ci.yml@v1
    with:
      service-name: orders-service
      language: go
      run-integration-tests: true
    secrets: inherit

# 平台级策略：强制标准标签
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: platform-standard-labels
spec:
  validationFailureAction: Enforce
  rules:
    - name: require-standard-labels
      match:
        resources:
          kinds: [Deployment, StatefulSet]
      validate:
        message: "所有部署必须包含平台标准标签"
        pattern:
          metadata:
            labels:
              app.kubernetes.io/name: "?*"
              app.kubernetes.io/team: "?*"
              app.kubernetes.io/version: "?*"
              environment: "?*"
---
# 平台级策略：禁止 latest 标签
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: disallow-latest-tag
spec:
  validationFailureAction: Enforce
  rules:
    - name: require-image-digest
      match:
        resources:
          kinds: [Deployment]
      validate:
        message: "镜像必须使用 Digest 而非 Tag"
        pattern:
          spec:
            template:
              spec:
                containers:
                  - image: "!*:latest"
---
# 平台级策略：强制资源限制
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: require-resource-limits
spec:
  validationFailureAction: Enforce
  rules:
    - name: check-resource-limits
      match:
        resources:
          kinds: [Deployment]
      validate:
        message: "所有容器必须设置 CPU 和 Memory limits"
        pattern:
          spec:
            template:
              spec:
                containers:
                  - resources:
                      limits:
                        memory: "?*"
                        cpu: "?*"
                      requests:
                        memory: "?*"
                        cpu: "?*"