Cloud Computing · advanced
Internal Developer Platform with Backstage, Crossplane, and Kyverno
A self-service platform on Kubernetes — developers pick a template in Backstage, Crossplane provisions the cloud resources declaratively, ArgoCD keeps it in sync, and Kyverno policies block anything that violates the rules. The platform-engineering stack, end to end.
Project overview
Platform engineering is the highest-paid track in cloud, and the role has shifted toward building a developer-facing product rather than running pipelines. A working self-service portal with guardrails is the canonical portfolio piece for it, and almost no one at entry level has one.
Real-world use case
A 40-engineer company wants any developer to get a new service with a database, a namespace, and CI in ten minutes, without a ticket to the infra team and without being able to skip security policy.
Tools and technologies
- Backstage
- Crossplane
- ArgoCD
- Kyverno
- Kubernetes (kind or vCluster)
- Helm
Skills you can demonstrate
Platform Engineering, GitOps, Policy as Code, Kubernetes Operators and CRDs, Developer Experience Design
Build roadmap
- Bootstrap the cluster and GitOps
Create a kind cluster, install ArgoCD, and set up an app-of-apps pattern so everything else in the project is deployed from Git. - Install Backstage
Deploy Backstage with the GitHub integration and register one existing service in the catalog. Get the portal loading before adding templates. - Write a software template
Create a scaffolder template that generates a service repo from a skeleton, opens it in GitHub, and registers it in the catalog automatically. - Add Crossplane compositions
Install Crossplane with a provider, define an XRD for an application environment, and write the Composition. Claim one from a template and watch it provision. - Enforce policy with Kyverno
Install Kyverno and add policies for resource limits, image tags, and required labels. Deploy something non-compliant and confirm it is rejected with a clear message. - Document the golden path
Write the developer-facing docs in Backstage TechDocs: how to create a service, what you get, and what the guardrails are. Present it as a product.
Ways to extend the project
Add a Backstage scorecard plugin that shows each service’s policy compliance, ownership, and deployment health on one page.
How to showcase your work
- GitHub: The platform repo with Backstage config, templates, Crossplane compositions, Kyverno policies, and an ArgoCD app-of-apps. Include an architecture diagram.
- LinkedIn: Record the golden path: click "create service" in Backstage, watch the repo appear, the resources provision, and a policy violation get rejected.
- Resume: Use the discipline’s vocabulary: "Built an internal developer platform with self-service templates, declarative provisioning, GitOps sync, and policy-as-code guardrails."