Platform Engineer

A production golden path template for a new microservice should include everything a team needs to ship safely from day one:

Minimum viable golden path — what to include:

service-template/
├── .github/workflows/
│   ├── ci.yml          # lint, test, build, push image
│   └── deploy.yml      # deploy to dev on merge, prod on tag
├── k8s/
│   ├── deployment.yaml  # resource limits pre-set, liveness/readiness probes
│   ├── service.yaml
│   └── hpa.yaml        # horizontal pod autoscaler
├── src/
│   └── main.ts         # health endpoint at /healthz already wired
├── Dockerfile           # multi-stage, non-root user, .dockerignore
├── opentelemetry.ts    # tracing + metrics pre-configured for your stack
├── CODEOWNERS          # ownership pattern
└── backstage-template.yaml  # Backstage Software Template descriptor

The non-negotiables:

• Health endpoint (/healthz) responding before template is accepted
• Resource requests and limits set (prevents node starvation)
• Default network policy: deny-all ingress except from service mesh
• Secret injection via Vault/AWS Secrets Manager (no env vars with plaintext secrets)
• Observability bootstrapped: metrics endpoint, structured logging, trace context propagation

Backstage scaffolder action to wire it up:

steps:
  - id: fetch-template
    action: fetch:template
    input:
      url: ./skeleton
      values:
        serviceName: ${{ parameters.serviceName }}
        owner: ${{ parameters.owner }}
  - id: create-repo
    action: publish:github
    input:
      repoUrl: github.com?owner=myorg&repo=${{ parameters.serviceName }}

Target: developer runs backstage scaffold, fills 5 fields, gets a repo with first CI passing in <5 minutes.