Markdown Editor

Platform Golden Path Specification Template

Golden path spec: target users, stack, scaffolding, CI/CD, environments, observability and security defaults, Backstage catalog

Architektur & SystemdesignStandardplatformgoldenpath

Anleitung: Use it when a platform team offers a supported route for one kind of service. Define target users, scope and stack first and validate them with real teams. The main pitfall is a path that is mandatory in practice but has no clear deviation process.

Vorschau

Platform Golden Path: [Path name]

Specification of one supported, opinionated route for building and running a type of software on the internal platform: who it is for, what it covers, the chosen stack, the scaffolding template, CI/CD, environments, observability and security defaults, service catalogue registration, support, adoption metrics and how to deviate. Based on common platform engineering practice; the catalogue example uses the Backstage catalog-info.yaml descriptor format. Replace every [bracketed] value and every row marked Example. Worked examples use a "Java HTTP service on Kubernetes" path.

FieldValue
Path name[Java HTTP service on Kubernetes]
Path ID[GP-003]
Version[2.1]
Status[Alpha / Beta / Generally available / Deprecated]
Owning platform team[@platform-runtime]
Product manager[@platform-pm]
Template repository[git URL @ tag]
Developer portal entry[Link]
Last updatedYYYY-MM-DD

1. Target users and problem

Target users: [Example: Stream-aligned teams building synchronous HTTP services in Java that store data in PostgreSQL.]

Problem today: [Example: Creating a production-ready service takes three to five weeks: teams copy an older service, re-create pipelines, request databases by ticket and wire monitoring by hand. Security findings repeat across services.]

Promise of the path: [Example: From empty repository to a service in production with monitoring, alerting and security scanning in under one day, without tickets.]

2. Path scope

In scopeOut of scope
Example: New HTTP services and APIsBatch jobs and stream processors (see GP-005)
Example: PostgreSQL and RedisOther databases (deviation process)
Example: Deployment to [shared Kubernetes clusters]Serverless functions
Example: Internal and public APIs behind the API gatewayServices needing PCI DSS scope (use GP-007)

The flow below shows the developer journey the path covers.

3. Opinionated stack

LayerChoiceVersion policyWhy
Language and runtimeExample: Java on Eclipse TemurinCurrent LTS; upgrade within 6 months of new LTSOrganisation skill base
FrameworkExample: Spring BootSupported release lineMature, wide knowledge
BuildExample: Gradle with organisation pluginPinned in templateShared conventions
DatabaseExample: Managed PostgreSQLPlatform-managed minor upgradesDefault relational store
CacheExample: Managed RedisPlatform-managedOptional module
API contractExample: OpenAPI document in api/Linted with organisation rulesetAPI-first review
Container base imageExample: Distroless Java imageRebuilt weeklySmall attack surface
Runtime platformExample: Kubernetes via Helm chart service-baseChart version pinnedShared operations
[Layer][Choice][Policy][Reason]

4. Scaffolding template

Inputs requested: service name, owning team, tier (1 to 3), database yes or no, public or internal API, data classification.

Generated:

  • repository with application skeleton, health endpoints, sample endpoint and tests;
  • OpenAPI document and contract test setup;
  • Dockerfile, Helm values per environment, pipeline definition;
  • catalog-info.yaml, README.md, docs/ with runbook and ADR folder;
  • dashboards and alert rules as code;
  • dependency update bot configuration.

Template lifecycle: changes to the template are released with versions; existing services receive upgrade pull requests from [tool].

5. CI/CD

StageWhat runsBlockingTime budget
Build and unit testCompile, unit tests, coverage reportYes5 min
Static analysisLinting, OpenAPI lint, SASTYes on high severity3 min
Dependency and image scanSCA, container scan, licence checkYes on critical3 min
SBOM and signingSBOM generated, image signed, provenance attestedYes1 min
Deploy to devAutomatic on mainn/a5 min
Integration and contract testsAgainst devYes10 min
Promote to staging and productionAutomatic for tier 3; one approval for tier 1 and 2Yes10 min

Lead time target from merge to production: [under 60 minutes].

6. Environments

EnvironmentPurposeDataCreatedAccess
PreviewPer pull requestSyntheticAutomatically, deleted on mergeTeam
DevIntegrationSyntheticWith serviceEngineering
StagingRelease verification, load testsAnonymised copyWith serviceEngineering
ProductionLive trafficRealWith serviceOn-call and break-glass only

7. Observability defaults

  • Structured JSON logs with trace ID, shipped to [log platform], retained [30 days].
  • OpenTelemetry tracing auto-instrumented; sampling [10%] plus all errors.
  • Metrics: RED (rate, errors, duration) per endpoint, JVM and pool metrics.
  • Dashboard per service generated from template.
  • Default SLO for tier 1: availability 99.9% over 30 days, p95 latency under [300 ms]; burn-rate alerts route to the owning team.

The default error budget follows from the SLO: (1−0.999)×30×24×60≈43(1 - 0.999) \times 30 \times 24 \times 60 \approx 43 minutes per 30 days.

8. Security defaults

ControlDefault
IdentityWorkload identity per service; no long-lived credentials
SecretsPulled from [secrets manager] at runtime; none in repository or images
NetworkDeny-all network policy plus declared dependencies; mTLS in mesh
IngressThrough API gateway with OAuth 2.0 token validation
ContainerNon-root user, read-only file system, no privilege escalation
DependenciesAutomated update pull requests; critical CVEs fixed within [7 days]
DataEncryption at rest and in transit; data classification label required

9. Service catalogue registration

The scaffolding creates this descriptor at the repository root; the catalogue discovers it automatically.

apiVersion: backstage.io/v1alpha1
kind: Component
metadata:
  name: order-history
  description: Read API for customers' past orders
  annotations:
    github.com/project-slug: example-org/order-history
    backstage.io/techdocs-ref: dir:.
  tags:
    - java
    - golden-path-gp-003
spec:
  type: service
  lifecycle: production
  owner: group:team-orders
  system: ordering
  providesApis:
    - order-history-api
  dependsOn:
    - resource:order-history-db
---
apiVersion: backstage.io/v1alpha1
kind: API
metadata:
  name: order-history-api
spec:
  type: openapi
  lifecycle: production
  owner: group:team-orders
  system: ordering
  definition:
    $text: ./api/openapi.yaml

10. Support model

TopicPlatform teamService team
Template, pipeline, base chartOwns and fixesApplies upgrade pull requests within [30 days]
Cluster and managed databasesOperates, on call 24/7Uses within quotas
Application code and dataAdvisesOwns, on call
Questions#platform-help, answer within 4 working hoursn/a
Office hours[Thursday 14:00]Optional

11. Adoption metrics

MetricBaselineTargetCurrent
Time from template to first production deploy3 to 5 weeks< 1 day[Value]
Share of new services created from the path0%80%[Value]
Services on the latest template version (within 30 days)n/a90%[Value]
Developer satisfaction with the path (survey, 1 to 5)n/a>= 4.0[Value]
Repeat security findings per service per quarter6< 1[Value]
Deviation requests per quartern/aTracked; trend reviewed[Value]

12. Deviation process

CategoryExamplesWho approvesConditions
Free choiceLibraries inside the service, test frameworksNobodyMust pass pipeline gates
Recommended defaultDatabase engine, frameworkTeam lead, recorded in ADRTeam accepts extra support responsibility
Enforced guardrailSecrets handling, image signing, network policySecurity lead and platform leadTime-limited exception with compensating control

Deviation requests are filed in [platform intake] and reviewed weekly. Each approved deviation is recorded below and considered for the path roadmap.

IDServiceDeviationReasonApproved byExpires
DEV-01Example: search-indexerUses OpenSearch instead of PostgreSQLFull-text relevance needs@team-lead (ADR-019)n/a
[DEV-NN][Service][Deviation][Reason][@name]YYYY-MM-DD

Standard and licence note

Based on common platform engineering practice for golden paths (also called paved roads). The catalogue descriptor example follows the Backstage software catalog descriptor format (backstage.io/v1alpha1, kinds Component and API) as documented at https://backstage.io; Backstage is a CNCF project and no documentation text is reproduced. All text and examples are original to this collection. Template licence: MIT.

Ähnliche Vorlagen