Architecture
Self-Service Platform
Developers click a template; the portal produces a pull request. Nothing reaches an environment without peer review and an audit trail.
What you're looking at
A developer picks a template in Backstage. The portal does not provision anything directly — it produces Terraform, which Atlantis plans and comments back onto a pull request. A human approves, Atlantis applies, and the change lands across environments. Config Connector sits alongside, representing cloud resources as Kubernetes objects so they reconcile the same way workloads do.
Why the portal deliberately cannot provision
A self-service portal with direct cloud credentials is a very fast way to create untracked infrastructure. Routing everything through a pull request keeps the audit trail, the peer review and the rollback path that a ticket-based process had, while removing the wait. Self-service is about latency, not about removing review.
What goes wrong here
Templates rot. A golden path written a year ago pins an old module version, and every service created from it inherits the same drift. The other failure is a plan nobody reads: Atlantis comments a hundred-line diff, the reviewer approves on trust, and the review becomes ceremony. Small templates and small plans are the fix.
Inspect it yourself
What would actually change?
terragrunt run-all plan --terragrunt-non-interactive 2>&1 | grep -E '^ # |Plan:' | head -40Read the resource-level lines rather than the summary. 'Plan: 3 to add, 1 to change, 1 to destroy' hides which resource is being destroyed.
Has anyone changed things by hand?
terraform plan -detailed-exitcode >/dev/null 2>&1; test $? -eq 2 && echo 'DRIFT: live does not match code'Exit code 2 means a non-empty diff. Run it on a schedule — drift found on a Tuesday is cheaper than drift found during an incident.
Config Connector resources not reconciling
kubectl get gcp -A -o json | jq -r '.items[] | select(.status.conditions[]?.status != "True") | "\(.kind)/\(.metadata.name)"'A resource stuck not-Ready usually means IAM on the controller service account, not a bad manifest.
Read the source
Components
- DEVELOPER
- BACKSTAGE— self-service portal
- CONFIG CONNECTOR— cloud as k8s objects
- TERRAFORM— + terragrunt
- ATLANTIS— plan → review → apply
- DEV
- STAGING
- PROD
Flows
- dev→backstageone click
- backstage→cc
- backstage→tftemplate
- tf→atlplan
- atl→dev-env
- atl→stg
- atl→prodapply