┌──────────────────────────────────────────────┐
│         Backstage Frontend (React)           │
│  ┌───────┐ ┌────────┐ ┌───────┐ ┌─────────┐ │
│  │Catalog│ │TechDocs│ │K8s    │ │Templates│ │
│  └───────┘ └────────┘ └───────┘ └─────────┘ │
└──────────────────┬───────────────────────────┘
                   │ REST API
┌──────────────────▼───────────────────────────┐
│         Backstage Backend (Node.js)          │
│  ┌────────┐ ┌─────────┐ ┌──────────────────┐│
│  │Catalog │ │Scaffolder│ │Plugin Manager    ││
│  │Engine  │ │Engine    │ │                  ││
│  └────────┘ └─────────┘ └──────────────────┘│
│  ┌────────┐ ┌───────┐   ┌──────────────────┐│
│  │Auth    │ │Search │   │TechDocs Engine   ││
│  └────────┘ └───────┘   └──────────────────┘│
└──────────────────┬───────────────────────────┘
                   │
┌──────────────────▼───────────────────────────┐
│       PostgreSQL (Catalog Database)          │
└──────────────────────────────────────────────┘

# 集群要求：K8s v1.27+
kubectl create namespace backstage

# 安装 PostgreSQL（生产环境建议用云厂商托管版）
kubectl apply -f - <<EOF
apiVersion: v1
kind: Secret
metadata:
  name: backstage-postgres
  namespace: backstage
type: Opaque
stringData:
  POSTGRES_USER: backstage
  POSTGRES_PASSWORD: $(openssl rand -base64 32)
---
apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: postgres
  namespace: backstage
spec:
  serviceName: postgres
  replicas: 1
  selector:
    matchLabels:
      app: postgres
  template:
    metadata:
      labels:
        app: postgres
    spec:
      containers:
      - name: postgres
        image: postgres:16-alpine
        env:
        - name: POSTGRES_USER
          valueFrom:
            secretKeyRef:
              name: backstage-postgres
              key: POSTGRES_USER
        - name: POSTGRES_PASSWORD
          valueFrom:
            secretKeyRef:
              name: backstage-postgres
              key: POSTGRES_PASSWORD
        - name: POSTGRES_DB
          value: backstage
        ports:
        - containerPort: 5432
        volumeMounts:
        - name: postgres-data
          mountPath: /var/lib/postgresql/data
  volumeClaimTemplates:
  - metadata:
      name: postgres-data
    spec:
      accessModes: ["ReadWriteOnce"]
      resources:
        requests:
          storage: 20Gi
---
apiVersion: v1
kind: Service
metadata:
  name: postgres
  namespace: backstage
spec:
  selector:
    app: postgres
  ports:
  - port: 5432
EOF

app:
  title: 开发者平台
  baseUrl: https://backstage.your-domain.com

backend:
  baseUrl: https://backstage.your-domain.com
  listen:
    port: 7007
  database:
    client: pg
    connection:
      host: ${POSTGRES_HOST}
      port: ${POSTGRES_PORT}
      user: ${POSTGRES_USER}
      password: ${POSTGRES_PASSWORD}

auth:
  providers:
    github:
      development:
        clientId: ${GITHUB_CLIENT_ID}
        clientSecret: ${GITHUB_CLIENT_SECRET}

catalog:
  import:
    entityFilename: catalog-info.yaml
    pullRequestBranchName: backstage-integration
  rules:
    - allow: [Component, System, API, Resource, Location]

kubernetes:
  serviceLocatorMethod:
    type: 'multiTenant'
  clusterLocatorMethods:
    - type: 'config'
      clusters:
        - name: 'prod-cluster'
          url: 'https://k8s-api.prod.example.com'
          authProvider: 'serviceAccount'
          serviceAccountToken: ${K8S_SA_TOKEN}

techdocs:
  builder: 'local'
  generator:
    runIn: 'docker'
  publisher:
    type: 'local'

apiVersion: apps/v1
kind: Deployment
metadata:
  name: backstage
  namespace: backstage
spec:
  replicas: 2
  selector:
    matchLabels:
      app: backstage
  template:
    metadata:
      labels:
        app: backstage
    spec:
      containers:
      - name: backstage
        image: your-registry/backstage:v1.0.0
        ports:
        - containerPort: 7007
        env:
        - name: POSTGRES_HOST
          value: postgres.backstage.svc.cluster.local
        - name: POSTGRES_PORT
          value: "5432"
        # ... Secret 引用省略
        resources:
          requests:
            cpu: 500m
            memory: 1Gi
          limits:
            cpu: 2000m
            memory: 2Gi
        livenessProbe:
          httpGet:
            path: /healthcheck
            port: 7007
          initialDelaySeconds: 30
        readinessProbe:
          httpGet:
            path: /healthcheck
            port: 7007
          initialDelaySeconds: 10
      serviceAccountName: backstage
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: backstage
  namespace: backstage
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-prod
spec:
  ingressClassName: nginx
  tls:
  - hosts:
    - backstage.your-domain.com
    secretName: backstage-tls
  rules:
  - host: backstage.your-domain.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: backstage
            port:
              number: 7007

apiVersion: v1
kind: ServiceAccount
metadata:
  name: backstage
  namespace: backstage
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: backstage-reader
rules:
- apiGroups: [""]
  resources: ["pods", "services", "configmaps", "namespaces"]
  verbs: ["get", "list", "watch"]
- apiGroups: ["apps"]
  resources: ["deployments", "replicasets", "statefulsets"]
  verbs: ["get", "list", "watch"]
- apiGroups: ["networking.k8s.io"]
  resources: ["ingresses"]
  verbs: ["get", "list", "watch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: backstage-reader
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: backstage-reader
subjects:
- kind: ServiceAccount
  name: backstage
  namespace: backstage

apiVersion: backstage.io/v1alpha1
kind: Component
metadata:
  name: payment-service
  description: 支付服务 - 处理订单支付与退款
  annotations:
    github.com/project-slug: your-org/payment-service
    backstage.io/kubernetes-id: payment-service
    backstage.io/techdocs-ref: dir:.
  tags: [java, spring-boot, payment]
spec:
  type: service
  lifecycle: production
  owner: payment-team
  system: ecommerce-platform
  providesApis: [payment-api]
  dependsOn:
    - component:order-service
    - resource:payment-db

apiVersion: backstage.io/v1alpha1
kind: API
metadata:
  name: payment-api
spec:
  type: openapi
  lifecycle: production
  owner: payment-team
  definition:
    $text: https://payment-api.your-domain.com/v3/api-docs
---
apiVersion: backstage.io/v1alpha1
kind: Resource
metadata:
  name: payment-db
  description: 支付数据库 (PostgreSQL)
spec:
  type: database
  owner: payment-team
  system: ecommerce-platform

annotations:
  backstage.io/techdocs-ref: dir:.