raffaelespazzoli / backstage-demo Goto Github PK

• s/Oauth app in this organization for Code Ready Workspaces/Oauth app in this organization for Eclipse Che/g
• We could link to the documentation in step 8 ("create a GitHub Application for the vault-config-operator")
• s/create and account/create an account/g
• secrets.sh has some quay info but in the steps above there is no quay instructions. Maybe there is a step missing to create a quay token? But anyway what accesses are needed by the quay token?
• In secrets.sh the variable cockroachdb_key=<service_account_name> should have the "API Key ID" or the "API Key Name"?
• Fork + clone of https://github.com/raffaelespazzoli/backstage-demo should happen at the very beginning, before we start editing secrets.sh at least.
• Running find . -type f -not -path '*/\.git/*' -exec sed -i "s/raffaelespazzoli/${github_organization}/g" {} + I got the error sed: 1: "./secrets.sh": invalid command code . (on macos gnu-sed is required)
• We should mention to connect to https://openshift-gitops-server-openshift-gitops.apps.${base_domain} to check apps deployment and re-synch
• After a few hours setting all up I figured out that my cluster doesnt' have enough resources, maybe we should mention a typical cluster where this demo is supposed to work? Mine has 3 worker nodes of type m6i.large (2 vCPU and 8GB or RAM each) and some pods failed to install because there were no available nodes.

When creating a new service from a software template, the template currently populates options from a hard-coded list in the template itself.. e.g. https://github.com/etsauer-acme/software-templates/blob/main/scaffolder-templates/quarkus-template/template.yaml#L65

In a real enterprise envrionment, we would want backstage to take in a user's PAT, and do some sort of evaluation to populate a list based on what orgs or groups a developer has access to. Not sure if this is possible, but something to look into later.

• decide on the tooling. Not sure what goes here, but there will be a need for an evidence/attestation wharehouse and a policy enforcer. I'd like to use sigstore and kiverno if they fit the bill.
• deploy the tooling. using gitops
• enhance the pipeline to use the tooling
• implement one policy to prove the concept, possibly an image signature verification.