sourcefuse / backstage Goto Github PK

Define a Security Model

• AWS
• GitHub
• Backstage Itself

Describe the bug
After the microservices repo scaffolding, we need to add docker related secrets to github for github actions to perform docker build and docker push. This is not working because the repo which is created, the creator from Backstage is not admin there by default.

To Reproduce
Steps to reproduce the behavior:

1. Go to 'https://dx.arc-prod.link/catalog'
2. Click on 'Create' and choose ARC microservices template
3. Let it complete and at the end it will generate a repo in sourcefuse org
4. Go to the repo and see that you dont have access to Admin tab

Expected behavior
The creatot from Backstage should at least get Admin permission of the repo.

Screenshots
If applicable, add screenshots to help explain your problem.

Additional context
Add any other context about the problem here.

Is your feature request related to a problem? Please describe.
Multi Environment Backstage GitHub App Set up

Describe the solution you'd like
Create multiple GitHub App configurations for local, poc/dev, and production environments.

https://backstage.io/docs/integrations/github/github-apps/

Is your feature request related to a problem? Please describe.
terraform/iam needs to be relocated to our management repo to avoid changes to the permission of the assumed role.

Describe the solution you'd like
terraform/iam needs to be relocated to our management repo.

Is your feature request related to a problem? Please describe.
Add Terraform configuration to create a GitHub App that can be used for authenticating to Backstage instead of using PAT / manually creating this resource.

Describe the solution you'd like
Add Terraform configuration to create the GitHub App

Is your feature request related to a problem? Please describe.
It's very difficult to perform local development due to the GitHub App Usage

Describe the solution you'd like

• Create a process for creating a GitHub app that individual users can utilize for local development that is against their individual user account
• Script or automate with IaC if possible

Describe alternatives you've considered

• Manual maintenance which we have outgrown

Additional context
See Slack Channel for additional information

Define all templates for V1

Infrastructure Deployment to all environments

Right now, the Tag workflow is using the sf-arc-ci PAT to tag the repo and kick off a new workflow for docker builds. This needs to be update to use the GH Actions GITHUB_TOKEN to avoid having to manage this PAT long term. With Action tokens, though, we cannot chain the workflows together. The tag step will need to push the update tag value to SSM where the downstream dependent workflows will be able to pick it up and use for the different jobs.

Since we use convention based names that only differ between the namespace and environment, many variables can be refactored to locals.

Push Docker Images to Sourcefuse DockerHub

• Seed repos and templates are out of date with upstream changes to the Git repos. Update app-config.yml to point to the correct repositories and remove out dated templates.

Move from sourcefuse/sourcefuse-backstage to sourcefuse/backstage.

• Builds the Docker Image
• Pushes it to ECR
• Updates the SSM parameter for the docker image
• Runs the Terraform against the POC 2 account for a PR that is raised against the main branch.
• Runs the Terraform against the PROD account following a merge to main. Only clean and tested PRs can be merged to main and only PROD ARC Admins can approve a PR to main.

Move the backstage-ecs module from arc-devops-infra into this repository and hook up to CD pipeline.

Design custom GitHub synchronization process. See here - https://backstage.io/docs/integrations/github/org/

Is your feature request related to a problem? Please describe.

• include iac to backstage
• resolve node_modules's migration problem: on executing "npm i", some migration files of packages @backstage/plugin-auth-backend,@backstage/plugin-catalog-backend,@backstage/plugin-scaffolder-backend are missing.

Describe the solution you'd like
A clear and concise description of what you want to happen.

Describe alternatives you've considered
A clear and concise description of any alternative solutions or features you've considered.

Additional context
Add any other context or screenshots about the feature request here.

We need to remove this action step and utilize the instance profile instead for deploying the container image to this account.

https://github.com/sourcefuse/sourcefuse-backstage/blob/b79721686d3e880dccefd41712e1486cf38de6a4/.github/workflows/docker-ci.yaml#L23

Describe the bug
Update to the latest version of @sourceloop/cli

Increase the ephemeral storage on the ECS volume to the maximum so that local docs generation works correctly.

Describe the bug
After logging in, when we open any component, it is again asking for login. Even though this is happening first time only but its not something which is expected.

To Reproduce
Steps to reproduce the behavior:

1. Go to 'https://dx.arc-prod.link/'
2. Login via github
3. Click on 'Home'
4. Open any component like arc/loopback4-audit-log
5. Note that it will again ask for login

Expected behavior
It should not ask for login again since we have already logged in via github

Screenshots

Additional context
Add any other context about the problem here.

Describe the bug
Following the branding, the Task Activity page is missing the links to the Backstage catalog and GitHub for the newly created component.

To Reproduce
Steps to reproduce the behavior:

1. Scaffold any component using the Create Component flow.
2. The Task Activity page no longer shows the links to the Backstage catalog info or GitHub repo.
3. Scroll down to '....'
4. See error

Expected behavior
The Task Activity page no longer shows the links to the Backstage catalog info and GitHub repo.

Screenshots
If applicable, add screenshots to help explain your problem.
Default

Now

Plugins that are part of the marketplace that we should assess for viability.

Kubernetes · Backstage Software Catalog and Developer Platform

backstage/README.md at master · backstage/backstage (github.com)

Backstage GitHub Pull Requests Plugin | Roadie

backstage/plugins/github-actions at master · backstage/backstage

Backstage GitHub Insights Plugin | Roadie

backstage/README.md at master · backstage/backstage (github.com)

Backstage AWS Lambda Plugin | Roadie

Backstage Argo CD Plugin | Roadie

backstage/README.md at master · backstage/backstage (github.com)

backstage/plugins/allure at master · backstage/backstage (github.com)

K-Phoen/backstage-plugin-grafana: Grafana plugin for Backstage (github.com)

backstage/plugins/graphiql at master · backstage/backstage (github.com)

Backstage Jira Plugin | Roadie

backstage/plugins/jenkins at master · backstage/backstage (github.com)

backstage/plugins/kafka at master · backstage/backstage (github.com)

backstage/plugins/newrelic at master · backstage/backstage (github.com)

backstage/plugins/newrelic-dashboard at master · backstage/backstage (github.com)

Backstage Prometheus Plugin | Roadie

Backstage Security Insights Plugin | Roadie

backstage-plugin-snyk/README.md at main · snyk-tech-services/backstage-plugin-snyk (github.com)

backstage/README.md at master · backstage/backstage (github.com)

• Sonar
• New Relic
• Cypress/UI testing?

The IaC needs the SemVer passed to it instead of the branch name

                  ~ image                  = "***.dkr.ecr.us-east-1.amazonaws.com/sourcefuse-backstage:0.1.0" -> "***.dkr.ecr.us-east-1.amazonaws.com/sourcefuse-backstage:main"

Describe the bug
A clear and concise description of what the bug is.

To Reproduce
Steps to reproduce the behavior:

1. Go to '...'
2. Click on '....'
3. Scroll down to '....'
4. See error

Expected behavior
A clear and concise description of what you expected to happen.

Screenshots
If applicable, add screenshots to help explain your problem.

Additional context
Add any other context about the problem here.

Describe the bug
× ERROR in ../../node_modules/swagger-ui-react/node_modules/react-redux/dist/react-redux.mjs 1097:18-45

To Reproduce
Steps to reproduce the behavior:

1. Go to '...'
2. Click on '....'
3. Scroll down to '....'
4. See error

Expected behavior
A clear and concise description of what you expected to happen.

Screenshots
If applicable, add screenshots to help explain your problem.

Additional context
Add any other context about the problem here.

Go through all the existing and templates and test to make sure they still work. Create bugs for any templates that do not work.

Use ARC IaC to implement a version of the recommended deployment architecture of the docs site.

https://backstage.io/docs/features/techdocs/architecture/#recommended-deployment
https://backstage.io/docs/features/techdocs/how-to-guides/

Describe the bug
Not able to create Mono Repo using Backstage

To Reproduce
Steps to reproduce the behavior:

1. Followed the steps mentioned in https://sourcefuse.atlassian.net/wiki/spaces/SOURCEFUSE/pages/3706552407/Setting+up+a+mono-repo+on+Backstage
2. Exported required variables
3. executed docker-compose up –d and tried to access backstage using http://localhost:7007
4. It redirected to Github page to sign in.
5. While clicking on sign in , got 404 error, screenshot is attached

Expected behavior
Redirected to Backstage page of sign in

Screenshots
screenshot is attached

The Snyk integration is not enabled via IaC. Enable it and ensure that the Snyk plugin works correctly.

Description:
🚨 Alarm on ECS Deployment Failures 🚨

Issue Description
In the dynamic world of containerized applications, ensuring smooth deployments is paramount. However, failures in ECS (Elastic Container Service) deployments can sometimes occur due to various reasons such as misconfigurations, resource constraints, or infrastructure issues. To mitigate risks and maintain system reliability, we need to implement a mechanism to trigger alarms whenever an ECS deployment fails.

Reference :-
https://docs.aws.amazon.com/AmazonECS/latest/developerguide/deployment-alarm-failure.html

Where can we add/use GenAI in the code scaffolding process?

Describe the bug
Tech docs for components has stopped working on prod as well as poc env

To Reproduce
Steps to reproduce the behavior:

1. Go to 'https://dx.arc-prod.link/'
2. Use Github login to log into the system
3. Click on any component
4. Click on 'Docs' tab
5. See error

Expected behavior
Docs should work

Screenshots

Additional context
Same happens on poc env too

Is your feature request related to a problem? Please describe.
There are now conflicting tools to manage pre-commit hooks.

Describe the solution you'd like
Find a way to merge husky and pre-commit. The node ecosystem takes priority, so all IaC related tools should be integrated with the node ecosystem, i.e. pre-commit is called before husky, IaC commands are added to the package.json, etc.