An interactive guide to platform engineering
Platform engineering turns hard-won Azure, Kubernetes and supply-chain decisions into golden paths, so developers ship without carrying the whole cloud in their head. This is a tour of those ideas, built on a real, opinionated Internal Developer Platform that proves each one.
Platform engineering builds an Internal Developer Platform: a product, made by a dedicated team, that gives every other team a paved road to production. It treats the cloud's complexity as a problem to be abstracted once, well, instead of solved badly many times.
The platform absorbs the parts of the cloud a product team shouldn't have to master, so they keep their attention on their service.
An enabling team runs it with golden paths as features, real users, and a roadmap, not a ticket queue.
You build it, you run it, on rails. The safe, compliant choice is the default choice; stepping off the path is a deliberate, reviewed exception.
Eight ideas at the heart of platform engineering, each paired with how this project realises it and a link to the exact place in the repository that proves it.
paved roads
A golden path is the supported, well-lit way to build and run a service. It packages the platform's hard decisions into a default route so teams don't reinvent CI, security or delivery for every service.
How this platform does it
Three Backstage templates (AKS microservice, ACA service, AKS workload namespace) scaffold a repo with CI, SBOMs, signing, GitOps, SLOs, dashboards, cost tags, TechDocs and ownership wired in from the first commit.
reduce cognitive load
Developers should reach a running, governed service without filing tickets or learning the whole cloud. The platform is a product; paved roads are its features.
How this platform does it
Teams consume golden paths through the Backstage portal and reach a running endpoint without touching the Azure portal. Vending turns a reviewed request into identity, RBAC, quota and a namespace automatically.
Flux is the source of truth
Desired cluster state lives in Git and a controller continuously reconciles the cluster to match. Changes are reviewed pull requests; drift is corrected automatically.
How this platform does it
Flux owns in-cluster state from a separate platform-cluster-state repository, so a bad cluster change can never take down the platform's Terraform state. Vended teams receive manifests there; merge triggers reconciliation.
guardrails, not gates
Governance is expressed as version-controlled, testable policy at three honest layers: the cloud control plane, infrastructure plan-time, and the cluster admission path.
How this platform does it
Azure Policy governs the Azure control plane, OPA/Rego via conftest validates Terraform plans, and Kyverno is the single in-cluster admission and mutation engine. The Gatekeeper add-on is intentionally not used.
private, least-privilege
Security is the baseline every environment inherits, not an add-on. The safe choice is the default choice, and relaxing it is a deliberate, reviewed exception.
How this platform does it
Private AKS API server, Workload Identity, Azure CNI Overlay with Cilium, default-deny egress through the hub firewall, Private Link for Key Vault, ACR and Postgres, and Kyverno-verified signed images. Even demo relaxes cost SKUs, never the security model.
signed & scanned
An artifact should be traceable to its source and verified before it runs. Identity replaces stored secrets; signatures and SBOMs make provenance checkable.
How this platform does it
GitHub authenticates to Azure with OIDC federation (no static cloud secrets). Images are signed with cosign keyless, SBOMs and vulnerability scans gate releases, and Kyverno refuses unsigned images at admission.
one owner per layer
Every layer of desired state has exactly one owner. Clear boundaries keep blast radius small and stop two systems fighting over the same resource.
How this platform does it
The enterprise ALZ owns management groups and tenant policy. Terraform owns subscription and platform infrastructure. Flux owns Kubernetes state. Azure Service Operator owns workload Azure dependencies. Backstage only initiates; it is never a source of truth.
cost is a first-class signal
Teams can only manage spend they can see. Cost is allocated to the team and product that incurred it and surfaced where engineers already work.
How this platform does it
Mandatory tags (owner, product, costCenter, env) flow from Cost Management exports through an allocator into a showback pipeline, surfaced per team and product in Backstage Cost Insights.
The platform as a real, connected system. Explore the live diagram, or switch to the capability layers. Either way, every component links to what it is, why it's there, who owns it, and the decision record behind it.
The private AKS cluster, registry, secrets and database that every workload shares, all behind Private Link.
Shared, hardened services mean teams inherit a secure substrate instead of standing up (and securing) their own.
The same Terraform targets demo, nonprod andprod. It stays approachable and cheap to evaluate, yet production-capable at full tier. Switch a profile to see how posture shifts across cost, availability and security.
Follow one namespace request along a golden path, from a Backstage form to a running, governed namespace. Every hop produces a real, reviewable artifact. Press play, or step through it yourself.
01 / 08
A developer opens the Backstage portal and picks a golden-path template, then describes the service: ownership, product, cost centre, environment and runtime.
team: payments
product: checkout
environment: nonprod
namespace: checkout
quotaTier: small
costCenter: cc-12345
dataClassification: confidential
onCall: payments-primaryMandatory tags travel with every resource, so spend is allocated to the team and product that incurred it, then surfaced where engineers already work. Group the showback to see where the money goes.
Figures are clearly-labelled representative data, in USD per month. In the
platform, mandatory owner, product and costCenter tags drive real showback in Backstage Cost Insights.
The same platform serves very different people. Pick the role that fits you to trace a journey through it, and watch the concepts that matter to you light up.
Select a persona to trace their journey through the platform. The concepts that serve them light up above.
This whole site is the front door. The platform itself, its Terraform, policies, workflows and Backstage templates, lives in the open. Stand it up on a subscription beneath your existing Azure Landing Zone.