FPT SoftwareFHNCertificationsReference architectures
Talk to NGT
Platform Engineering · 02 of 6

Internal developer platform

The five planes, the self-service engine behind the portal, what teams see and how environments are governed.

Self-Service Infrastructure Engine
01

Five planes of an internal developer platform

The portal is what developers see; the planes below it do the work.

  1. 01Developer portalService catalogue, golden-path templates, docs and each application's status.BackstageService catalogueTemplatesDocs
  2. 02Orchestration & control planeTurns a request into workflows, approvals and environment changes.CrossplaneKubeVelaWorkflowsApprovals
  3. 03Pipelines & deliveryCI/CD and GitOps that build, test, scan and deploy every change.GitLab CIGitHub ActionsJenkinsArgo CD
  4. 04Infrastructure & runtimeInfrastructure as code on the runtime you use.TerraformAWS CDKKubernetesECS · EC2
  5. 05Observability & securityTelemetry, policy as code, scanning and cost, across every plane.Prometheus · GrafanaPolicy as codeImage scanningCost per team
Identity & access: single sign-on (OIDC) · a role per environment · audit log
02

From a short form to Terraform

The engine behind the self-service catalogue of an internal developer platform we built inside FPT Software.

Self-Service Infrastructure Engine
requesttoken checkwatchednew jobcredentialsapply · destroyPlatform services · main Kubernetes clusterExecution cluster · one job per runManagement accountProject's target accountDeveloperCorporate directoryDeveloper portalcatalogue · formsKeycloaksingle sign-onAPI gatewayKongCloud-servicebackendPostgreSQLprojects · requestsKubeVelacloud-app resourcesTerraform controllercustomTerraform jobplan · apply · destroyAWS Secrets Managerproject credentialsAmazon CloudFrontstatic webAmazon S3site · logsAmazon EC2VM packages

Point at a component to light its links; select it for what it does here and the practice that makes it right on AWS.

Point at a component to see what it does; select it for the best practice.Open the architecture
03

What each team sees in the portal

Shown: the Terraform log of a self-service request on an internal developer platform we built inside FPT Software.

  • Service catalogueEvery system with its owner, repositories, pipelines and environments.
  • Self-service infrastructureRequest resources from a form; the portal shows the Terraform run and its outputs.
  • Credentials and resourcesProject credentials and cloud resources in one view, granted by role.
  • Cost and one-click operationsCost per component with budget alerts; promote or redeploy in one click.
A developer portal page for a static website created from the self-service catalogue, showing the Terraform plan log
04

Environments and approvals

A typical approval model on a golden-path platform. One configuration database is the source of truth.

EnvironmentWho deploysApprovalAccess
DevelopmentTeam members, freelyNoneBy role
StagingTeam membersProject managerBy role, per project
ProductionThe pipeline, on releaseChange ticket + platform adminTime-boxed; every action in an immutable log
05

Building blocks we use

Open-source and cloud-native parts, chosen per client. None of them is mandatory.

Portal & identity

backstageKeycloak

Orchestration & IaC

crossplanekubevelaterraformaws-cdkansible

CI/CD & GitOps

gitlabgithubjenkinsaws-codepipelineargo

Runtime

kubernetesamazon-ekshelmdockerAmazon ECS

Registry & scanning

HarborNexustrivysonarqubeVeracode

Observability

prometheusgrafanagrafana-lokigrafana-tempodatadog
SourcesNGT Platform Engineering deck v1.2 (Sep 2026)NGT Platform Engineering Service Offering v1.0 (2025)NGT Service Offering v3.2 (Jul 2026)NGT Service Offering v2.0 (Mar 2025)NGT FinOps Service Offering (Mar 2025)