Backstage Cicd
To set up backstage cicd, link your build system to your software catalog. Then add plugins so teams can watch job runs in the portal. Most teams start by giving the portal a broad API key. This key lets the portal read build logs and start new runs. When these keys have too much power, any user can trigger deploys. Broad runner roles can also change live apps without a clear audit trail. How the native backstage cicd workflow operates The developer portal acts as a single pane of glass for y
Backstage Security Plugins: the complete guide
Architecture patterns, implementation strategies, and security best practices. Delivered to your inbox.
To set up backstage cicd, link your build system to your software catalog. Then add plugins so teams can watch job runs in the portal. Most teams start by giving the portal a broad API key. This key lets the portal read build logs and start new runs. When these keys have too much power, any user can trigger deploys. Broad runner roles can also change live apps without a clear audit trail.
How the native backstage cicd workflow operates
The developer portal acts as a single pane of glass for your apps. It reads metadata files that live inside your source code repos. These files tell the catalog which build pipeline belongs to each service. When a developer opens a service page, the portal calls the build tool. It uses a stored token to fetch the latest run status and logs.
Teams can also use software templates to spin up new projects fast. A template takes user inputs and creates a fresh repo with build files. It then registers the new component inside the central catalog right away. The build tool spots the new repo and runs the first pipeline job. From that point on, developers watch build steps from the portal UI.
Managing permissions across portal plugins and build runners
Two sets of permissions control what happens in this workflow. First, portal role rules decide who can see or click buttons inside the UI. Second, runner roles decide what the build agent can do in the cloud. Many teams tie the portal to their build tool with one shared key. This means the build tool sees every request as the same system user.
Even if you lock down the UI, the runner still holds heavy keys. Build agents need broad rights to push code, run scripts, and update databases. Teams often place long-lived cloud keys or database passwords in the runner store. Anyone who can change a pipeline file can make the runner use them. A simple code push can run arbitrary commands against live production systems.
Backstage Security Plugins: architecture patterns and best practices
Continue reading? Get the full guide.
Free. No spam. Unsubscribe anytime.
What the native setup solves and where gaps remain
Connecting your build pipelines to a catalog solves major visibility problems for teams. Developers do not have to hunt through ten tabs to find failed builds. New hires can ship a working service on day one using standard templates. Platform teams can check which services pass tests and which ones fail often. The native setup handles catalog tracking and basic job triggers very well.
Yet this setup only controls who can log in and start a job. It does not check the actual commands or queries that run in flight. Once a build step starts, the runner uses its broad role without checks. If a script runs a bad database query, the native setup allows it. If a build log prints customer emails or phone numbers, everyone sees them. You still need a way to inspect each command and mask sensitive data.
Check database and API queries on the wire
Identity tools, roles, and network rules decide who opens a session. Setup alone cannot check what each query does or mask sensitive values in a response once a session starts. When workflows touch Postgres, MySQL, SQL Server, MongoDB, ClickHouse, Kubernetes APIs, SSH, or internal HTTP APIs, hoop.dev runs beside those services as an open-source proxy, a sidecar for your Postgres or API. It inspects requests coming in and results going back on the wire.
Your login details and client tools stay as they are while hoop.dev guardrails refuse bad deletes or drops before they run. On responses, hoop.dev data masking rewrites matched sensitive values in memory. Furthermore, hoop.dev holds SOC 2 Type II, is MIT licensed, and writes every query and decision to an audit trail that generates evidence for HIPAA, GDPR, and PCI DSS. See the source on GitHub.
Frequently asked questions
Does the developer portal run the build jobs itself?
No, the portal does not run your build or deploy jobs directly. It sends requests to your external build tool and displays the job status.
How do software templates set up new pipelines?
Templates copy starter code and pipeline files into a brand new code repo. Then they register the new repo in the catalog so builds show up.
Why are shared API keys risky for portal plugins?
A shared key hides which single user asked for a build or deploy. If a bad deploy runs, the audit log only shows the system account.