Implementing Service Governance
1. Defining Service Standards
| Standard | Detail |
|---|---|
| API style | REST / gRPC guidelines |
| Error format | RFC 9457 |
| Logs / metrics | OTel semantic conventions |
| Security baseline | OAuth, mTLS, scanning |
| Enforcement | Linters (Spectral), policy (OPA) |
2. Implementing Service Registry
| Element | Detail |
|---|---|
| Catalog | Backstage / Cortex |
| Metadata | Owner, tier, runbook, SLO |
| Source | YAML in repo (catalog-info.yaml) |
3. Managing Service Lifecycle
| Stage | Detail |
|---|---|
| Proposed | RFC + ADR |
| Active | Owned, on-call, SLO |
| Maintenance | Critical fixes only |
| Retired | Decommission plan |
4. Enforcing API Standards
| Tool | Use |
|---|---|
| Spectral | Lint OpenAPI/AsyncAPI |
| Buf lint / breaking | protobuf |
| CI gate | Block non-compliant PRs |
5. Implementing Service Ownership
| Element | Detail |
|---|---|
| CODEOWNERS | Per directory |
| Catalog owner | Team in Backstage |
| On-call | PagerDuty schedule per service |
6. Managing Service Dependencies
| Element | Detail |
|---|---|
| Declared deps | In catalog |
| Runtime deps | From traces |
| Cycle detection | Block circular deps |
7. Implementing Change Management
| Element | Detail |
|---|---|
| ADR | Architecture Decision Records |
| RFC process | Cross-team proposals |
| Change advisory | For high-risk changes |
| Deployment window | Avoid risky times |
8. Enforcing Security Policies
| Layer | Tool |
|---|---|
| Code | SAST in CI |
| Image | Trivy + signed (cosign) |
| K8s admission | Kyverno / OPA Gatekeeper |
| Mesh | mTLS enforced |
9. Managing Service Versioning
| Aspect | Detail |
|---|---|
| Image tag | SemVer + commit SHA |
| API version | Per public contract |
| Schema registry | Track event schemas |
10. Implementing Cost Management
| Practice | Detail |
|---|---|
| Tagging | Owner, env, service |
| Showback | Per-team cost reports |
| Budgets | Alerts on overrun |
| Tools | Kubecost, OpenCost, CUR |
11. Using Governance Tools
| Tool | Use |
|---|---|
| Backstage | Catalog + scorecards |
| Cortex | Service maturity |
| OPA / Kyverno | Policy |
| OpsLevel / Port | Commercial IDP |
12. Implementing API Gateway Governance
| Control | Detail |
|---|---|
| Onboarding | Require spec + owner + SLO |
| Quotas / plans | Per consumer |
| Auth required | No anonymous public APIs |
| Audit | All routing changes |