Designing Golden Paths

apiVersion: scaffolder.backstage.io/v1beta3
kind: Template
metadata:
  name: golden-path-rest-api
  title: REST API Service (Golden Path)
  description: Production-ready REST API with database, CI/CD, and monitoring
spec:
  owner: platform-team
  type: service
  parameters:
    - title: Service Details
      required: [name, team, database]
      properties:
        name:
          title: Service Name
          type: string
          pattern: '^[a-z][a-z0-9-]*$'
        team:
          title: Owning Team
          type: string
          ui:field: OwnerPicker
        database:
          title: Database Type
          type: string
          enum: [postgres, mysql, none]
          default: postgres
  steps:
    - id: fetch-skeleton
      name: Fetch service skeleton
      action: fetch:template
      input:
        url: ./skeleton
        values:
          name: ${{ parameters.name }}
          team: ${{ parameters.team }}
    - id: create-repo
      name: Create GitHub repo
      action: publish:github
      input:
        repoUrl: github.com?owner=myorg&repo=${{ parameters.name }}
        defaultBranch: main
        protectDefaultBranch: true
    - id: provision-infra
      name: Provision infrastructure
      action: custom:terraform-apply
      input:
        module: modules/service-infra
        vars:
          service_name: ${{ parameters.name }}
          database_type: ${{ parameters.database }}
    - id: register
      name: Register in catalog
      action: catalog:register

# policy/require-healthcheck.rego
package kubernetes.admission

import data.kubernetes.deployments

# Deny deployments without a readiness probe
deny[msg] {
  input.request.kind.kind == "Deployment"
  container := input.request.object.spec.template.spec.containers[_]
  not container.readinessProbe
  msg := sprintf(
    "Container '%s' in Deployment '%s' has no readiness probe. "
    "Use the golden path template or add one manually. "
    "Docs: https://platform.internal/docs/health-checks",
    [container.name, input.request.object.metadata.name]
  )
}