Platform Infrastructure Strategic Roadmap
H2 2026 · Platform Engineering
In H2 we consolidate the platform around three themes: abstracted self-service for developers, declarative automation end-to-end — from CI/CD and IaC to security policy — and unified observability across the estate. Backstage becomes the single, zero-friction entry point; everything beneath it is code.
01 · Developer Experience & Abstracted Self-Service
Deploy Backstage as a zero-friction, single pane of glass. Completely mask underlying infrastructure complexity (Terraform, OpenTofu, Ansible, etc.) behind intuitive UI forms and self-service software templates to enable one-click resource provisioning.
Evolve and scale the "Cogwork" desktop app to handle complex local operation automations, developer manual overrides, and daily localized engineering workflows.
Expose Kubernetes clusters, namespaces, and Harvester virtual machines as self-service catalog items in Backstage. A developer fills in a simple form; the platform backend automatically provisions the resource via IaC and GitOps pipelines — with sensible defaults, quotas, and ownership metadata applied out of the box.
Implement a standardized, compliant, and highly visible change management tracking workflow to safely log, review, and audit system releases.
02 · Advanced CI/CD & GitOps Engine
Deploy a GitOps engine (e.g., ArgoCD or Flux) to manage continuous infrastructure reconciliation, triggered purely by Backstage catalog actions or code merges.
Overhaul build and deployment pipelines to implement robust progressive delivery (canary/blue-green deployments), automated rollback strategies, parallelized test execution, and strict artifact signing for supply chain security.
03 · Under-the-Hood Infrastructure as Code (IaC)
Standardize the core platform backend on a unified Infrastructure as Code framework (e.g., Terraform, OpenTofu, or Pulumi) to manage multi-cloud, DNS, and bare-metal resources deterministically.
Codify database instance provisioning, default configurations, and schema migrations into automation pipelines. Developers request database resources via Backstage, while the platform backend utilizes GitOps to handle replication, backup schedules, and full lifecycle management out-of-sight.
04 · Zero-Trust Security & Automated Governance
Implement automated dynamic accounts with strict, short-lived Time-To-Live (TTL) cycles for databases, SSH target systems, and cloud provider API keys to eliminate static credentials.
Transition network security to policy-as-code workflows to automatically generate, validate, and deploy firewall rules across multi-cluster environments without manual human intervention.
05 · Core Infrastructure & Private Cloud
Architect, deploy, and harden Harvester Hyperconverged Infrastructure using backend IaC providers to establish a resilient, production-grade private cloud compute foundation.
Plan and execute the migration of existing KVM-based virtual machines onto the Harvester HCI platform, including workload inventory, phased cutover waves, and validation — retiring legacy hypervisor hosts once workloads are stable.
Deploy Apache Airflow as the platform's workflow orchestration engine for scheduled jobs, data pipelines, and cross-system operational automations, managed and versioned as code (DAGs in Git).
Redesign core DNS topology to improve fault tolerance, streamline internal domain routing, and manage public/private zone configurations exclusively via automated code pipelines.
Stand up a new Kubernetes cluster on the routed (L3) server fabric with MetalLB in BGP mode, migrate the existing services onto it in waves while both clusters run, and retire the legacy cluster once the last wave has cut over. Starts in parallel with the fabric work; the final cutover waits for every server rack to be on L3.
06 · Unified Observability & Monitoring Platform
Build or scale high-throughput pipelines for centralized metrics, distributed tracing, and structured logging.
Deploy an enterprise monitoring platform (e.g., Grafana LGTM stack, Datadog, or Prometheus) featuring automated intelligent alerting, real-time service-level indicator (SLI/SLO) dashboards, and full dashboard-as-code management.
07 · Build Audit System
Establish end-to-end build auditing that records who built what, when, and from which source revision — capturing build provenance, dependency manifests, and pipeline logs into an immutable, searchable audit trail for compliance and incident forensics.