Backstage refresh

Specific workThe pull request was merged and the integration was completed; a follow-on ticket was created for Grafana stack creation.

Team Lead contributionThe deliverable is credited to Cassidy; no separate leadership action was recorded for this item.

Backstage SME contributionThe work required Backstage template and plugin integration expertise.

Outcome / statusCompleted and merged.

BlockersNo blocker stated for the completed integration.

Follow-upCreate the Grafana stack template under the follow-on ticket.

Jira / deliverableDocumented Grafana integration ticket; the follow-on ticket number is not stated.

Specific workSplit the codebase into topic-specific plugin repositories, granted Aspirations-Team access to them, and moved backend plugins and scaffolder modules onto the new backend system.

Team Lead contributionShared both the legacy and refreshed repositories with the team, enabled access, prepared the planning material, and pointed contributors at the refreshed structure for new work.

Backstage SME contributionDefined the refreshed architecture, the plugin boundaries, the source-of-truth model, and the approach for consuming versioned plugin releases.

Outcome / statusSubstantially complete as of August 17: all six plugin repositories are live on GitHub with 29 of 36 packages ported, released as immutable per-package GitHub Releases, and consumed by the instance; every ported package carries at least 80% test coverage. The dataproxy family is the last engineering item, with its final packages in verification.

BlockersRemaining items are operational rather than engineering: GitHub App read-organization scope and per-organization reinstalls, Key Vault secret bootstrap for the new namespace, and deferred secret rotation.

Follow-upFinish the dataproxy release and instance wiring, complete the scaffolder template train into the instance, migrate catalog data, and execute cutover.

Jira / deliverableSix plugin repositories, migration-plan documents, and a 34-entry decisions log.

Specific workDocumented the useful entity annotations and brought template and skeleton files in line with the defined entity model.

Team Lead contributionUsed the shared catalog and template examples during team discussion and reviewed work from other contributors.

Backstage SME contributionApplied Backstage catalog, namespace, annotation, scaffolder, and entity-layout knowledge.

Outcome / statusIn progress as of August 13.

BlockersThe exact final entity model and all required template changes were not marked complete.

Follow-upComplete annotation documentation and update template/skeleton files.

Jira / deliverableEntity model document.

Specific workExecuted the cutover plan: technical review workshop held August 14 (including an AI-assisted-migration workflow walkthrough), release-artifact ingestion completed with a GitHub App token for cross-repository CI access, and the Kubernetes and Flux GitOps scaffold finished August 16 — base Backstage-plus-Postgres manifests, an ExternalSecrets overlay with no plaintext secrets in git, and image automation targeting the dedicated backstage-refresh namespace in the existing cluster.

Team Lead contributionCarried the decision points, prerequisites, ownership gaps, and next-step tasks into the alignment discussions; the reviewers' sign-off remains the documented prerequisite for any switchover decision.

Backstage SME contributionExplained the technical dependency chain across plugin releases, CI, registry push, Kubernetes identity, the new namespace, Flux, and catalog migration.

Outcome / statusAchieved: the refreshed instance went live at its own URL on August 20 (two days past the August 18 target — the slip bought a private npm registry and permanent in-cluster CI instead of the interim vendored-tarball flow). Both instances now coexist with no legacy code freeze — merged legacy pull requests are ported into the plugin repositories continuously.

BlockersOperational bootstrap items: Key Vault entries and workload-identity federation, container-registry repository, DNS record, GitHub App read-organization scope with per-organization reinstalls, and a first end-to-end sign-in verification.

Follow-upRun legacy and refresh side by side, execute and verify the catalog data migration against a production snapshot, then decide the DNS and auth switchover after review sign-off.

Jira / deliverableMigration plan deliverables, Kubernetes/Flux scaffold, and the cutover-blockers tracker.

Specific workStood up the full delivery infrastructure in three days: a self-provisioned Azure Key Vault with workload-identity federation (no ops dependency), a self-service container registry, a Verdaccio private npm registry deployed by Flux as the sole distribution channel for the plugin packages — replacing and removing the vendored-tarball workflow across three repositories — and self-hosted GitHub Actions runners inside the namespace after proving that no ingress on the cluster is internet-reachable. Diagnosed a foreign cluster-wide runner controller silently deleting the runner resources within seconds (isolated via a live watch and a 13-version probe matrix) and neutralized it with a Kubernetes admission policy; built a custom runner image in-cluster with kaniko when the upstream registry proved unreachable from workstations. The first fully automated deploy ran end to end on August 20: in-cluster Docker-in-Docker image build, registry push, Flux image automation committing the version bump over a deploy key, and rollout to a healthy instance at its own URL.

Team Lead contributionSequenced the registry-before-deploy plan, recorded seven new architecture decisions (39-45 in the decisions log) with the reasoning captured for review, and kept the remaining ops asks to a single optional item by converting every blocker into a self-service path.

Backstage SME contributionDesigned the registry consumption contract so a future managed registry replaces the stop-gap with config-only changes; root-caused a Verdaccio authentication limitation (token minting impossible with registration disabled) from its source and switched all seven repositories to basic-auth idents; wrote the infrastructure architecture TechDocs page with lifecycle diagrams.

Outcome / statusLive: the refreshed instance serves at backstage-refresh.dev.providesops.io as of August 20 with readiness passing, deployed exclusively through the GitOps loop — CI's only side effect is an image push; every deploy is an auditable git commit. All released plugin versions were backfilled into the registry with checksum verification against the pinned integrity hashes.

BlockersNone for the go-live. A single flaky test-timeout on the shared runners and the remaining plugin repositories' publish workflow migration are follow-ups, not blockers.

Follow-upBrowser smoke test of sign-in and scaffolder, registry-volume backup, publish-workflow migration for the four remaining plugin repositories, then the catalog migration and the DNS/auth switchover decision after reviewer sign-off.

Jira / deliverableLive environment, Verdaccio registry with backfilled package history, seven runner scale sets, custom runner image, admission-policy guard, infrastructure-architecture TechDocs page, and decisions-log rounds 12-13.

Specific workRan the technical cutover-readiness review after roughly one-and-a-half to two weeks of the refresh running parallel to legacy: completed the smoke tests Russell had recommended, validated the deployment and rollback scripts, and confirmed the legacy alias aspirations-legacy.dev.providesops.io gave a working rollback path pointed at the prior Backstage version. Committed to extracting styles and theming into an isolated display plugin, and agreed the stakeholder communication would cover the primary URL, legacy availability, expected UX differences, rollback plan, timing, and how to report issues.

Team Lead contributionMaintained the cutover checklist spreadsheet as the single source of truth referenced throughout the review, planned the full post-cutover verification pass (every plugin, template, and critical workflow, plus look-and-feel, authentication, catalog, scorecards, and admin checks), and agreed to draft the stakeholder communication with Liliana handling recipient list and send.

Backstage SME contributionCalled out the specific user-visible risks worth flagging in advance — sidebar, branding, and Business Unit differences — and the fact that some community-plugin behavior had shifted since an earlier validation pass.

Outcome / statusTechnical readiness was treated as substantially complete; the review concluded the remaining gate was stakeholder communication and approval, not further engineering.

BlockersStakeholder approval and communication timing — the target date moved to give recipients time to review.

Follow-upSend the stakeholder communication, execute the post-cutover validation plan, and extract the display plugin.

Jira / deliverableCutover checklist spreadsheet; rollback scripts and checklist; stakeholder communication draft.

Specific workReversed the planned DNS repoint: rather than swapping aspirations.dev.providesops.io onto the refresh namespace, the refreshed instance was provisioned its own canonical host, portal.dev.providesops.io (production will be portal.providesops.io), with the GitHub OAuth App callback updated in lockstep. portal.dev.providesops.io was then announced as the primary Backstage environment for new feature development; legacy aspirations.dev.providesops.io moved into maintenance-only mode (bug fixes only), left completely reachable and untouched.

Team Lead contributionMade the call to drop the switchover-day DNS risk entirely rather than schedule around it, voided the cutover plan's DNS/OAuth-repoint procedure and rollback rows in the same decision, and announced the new-development policy so teams stopped building against the environment being phased down.

Backstage SME contributionConfirmed the wildcard DNS zone already resolved the new host with zero additional records or certificates, and re-sequenced the baseUrl and OAuth-callback changes to deploy together.

Outcome / statusRefresh is live as the primary development environment at its own domain; legacy remains reachable in maintenance mode as the rollback and continuity path. A separate production namespace and QA-to-production workflow are still required before the non-dev production domain can go live. Catalog migration, the template train, and legacy decommission timing are unaffected by the DNS approach change.

BlockersProduction-cluster and QA-to-production deployment design still needs to be completed.

Follow-upDesign the production namespace and promotion workflow; keep the transitional alias until it is no longer used.

Jira / deliverableDecision 54 in the migration decisions log; updated k8s overlay and OAuth App configuration.

Specific workExtracted the portal's look-and-feel into its own backstage-plugins-theme repository rather than carving out a shell-code exception, keeping the "everything lives in a plugin" rule uniform. Ran a continuous stream of legacy pull-request ports (a full sweep of a colleague's August legacy changes produced six port pull requests in a single day), added an enforced GitHub-organization namespace rule to the catalog (both a migration-script fix and a runtime catalog processor), and promoted every 0.x package fleet-wide to a stable 1.0.0 with seven green pull requests across all plugin repositories.

Team Lead contributionKept the porting cadence going with no legacy code freeze, sequenced the 1.0.0 promotion so every repository moved together, and tracked deferred ratification items (naming collisions, backend-slimming parity) for a follow-up decision round.

Backstage SME contributionDesigned the theme plugin as a frontend-plugin-module for the app plugin so saved user theme selections carry over unchanged, and wrote the namespace-enforcement processor with an explicit shared-org opt-out for company-wide templates and resources.

Outcome / statusTheme package released and running on its own in-cluster CI runner scale set; namespace enforcement live in the catalog; all seven fleet-wide 1.0.0 pull requests merged on September 4, 2026. Both instances remain live in parallel with continuous parity porting.

BlockersThe follow-up cross-repository dependency-range bump (pinning consumers to the new 1.0.0 releases) is blocked on the releases actually publishing and on VPN access for a fresh lockfile.

Follow-upThe seven 1.0.0 pull requests and their version-bump trains merged; remaining work is the dependency-range and instance-pin waves, and swapping the instance's interim theme code for the released package. Naming-collision and backend-slimming parity items were deferred to a later decision round.

Jira / deliverableDecisions 55-56 in the migration decisions log; theme repository; namespace-enforcement processor; seven 1.0.0 release pull requests.

Specific workDelivered the stakeholder-facing update at the weekly platform engineering sync: refresh successfully deployed and users can be directed to it, built on a small core library with isolated plugin functionality, the 80% coverage goal achieved, and the entity-model changes implemented so users no longer need personal IMP-organization access under the intended cross-organization template model.

Team Lead contributionConnected the deployment to concrete access-model and entity-model improvements rather than presenting go-live as final completion, and set the following week's focus explicitly on validating every template path.

Backstage SME contributionExplained the architectural and productivity outcomes of the small-core-plus-plugins design to a non-engineering stakeholder audience.

Outcome / statusUpdate delivered; template-path validation set as the next milestone rather than treated as done.

Follow-upValidate all template paths; continue tracking production-cluster and QA-to-production design.

Jira / deliverableWeekly stakeholder update.