Port vs Backstage: Developer Portals for AWS EKS and AI Agent Self-Service

apiVersion: apps/v1
kind: Deployment
metadata:
  name: backstage
  namespace: backstage
spec:
  replicas: 2
  selector:
    matchLabels:
      app: backstage
  template:
    metadata:
      labels:
        app: backstage
    spec:
      serviceAccountName: backstage
      containers:
        - name: backstage
          image: 123456789012.dkr.ecr.us-east-1.amazonaws.com/backstage:latest
          imagePullPolicy: Always
          ports:
            - name: http
              containerPort: 7007
          envFrom:
            - secretRef:
                name: backstage-secrets
          resources:
            requests:
              memory: "512Mi"
              cpu: "250m"
            limits:
              memory: "1Gi"
              cpu: "1000m"
          readinessProbe:
            httpGet:
              path: /healthcheck
              port: 7007
            initialDelaySeconds: 30
            periodSeconds: 10
          livenessProbe:
            httpGet:
              path: /healthcheck
              port: 7007
            initialDelaySeconds: 60
            periodSeconds: 20
---
apiVersion: v1
kind: Service
metadata:
  name: backstage
  namespace: backstage
spec:
  selector:
    app: backstage
  ports:
    - port: 80
      targetPort: 7007
  type: ClusterIP
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: backstage
  namespace: backstage
  annotations:
    kubernetes.io/ingress.class: alb
    alb.ingress.kubernetes.io/scheme: internet-facing
    alb.ingress.kubernetes.io/target-type: ip
    alb.ingress.kubernetes.io/certificate-arn: arn:aws:acm:us-east-1:123456789012:certificate/xxx
spec:
  rules:
    - host: backstage.internal.example.com
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: backstage
                port:
                  number: 80

apiVersion: v1
kind: ServiceAccount
metadata:
  name: backstage
  namespace: backstage
  annotations:
    eks.amazonaws.com/role-arn: arn:aws:iam::123456789012:role/backstage-role

kubernetes:
  serviceLocatorMethod:
    type: multiTenant
  clusterLocatorMethods:
    - type: config
      clusters:
        - url: https://<EKS_ENDPOINT>
          name: production-eks
          authProvider: aws
          caData: <base64-encoded-CA>

helm repo add port-labs https://port-labs.github.io/helm-charts
helm repo update

helm install port-k8s-exporter port-labs/port-k8s-exporter \
  --namespace port-k8s-exporter \
  --create-namespace \
  --set secret.secrets.portClientId=<PORT_CLIENT_ID> \
  --set secret.secrets.portClientSecret=<PORT_CLIENT_SECRET> \
  --set clusterName=production-eks

secret:
  secrets:
    portClientId: "<PORT_CLIENT_ID>"
    portClientSecret: "<PORT_CLIENT_SECRET>"

clusterName: "production-eks"

resources:
  - kind: v1/namespaces
    selector:
      query: .metadata.name | startswith("prod-")
  - kind: apps/v1/deployments
  - kind: apps/v1/replicasets
  - kind: v1/pods
  - kind: v1/services
  - kind: batch/v1/jobs
  - kind: batch/v1/cronjobs

# Map Kubernetes resources to Port Blueprints
mappings:
  - kind: apps/v1/deployments
    port:
      entity:
        mappings:
          identifier: .metadata.name + "-" + .metadata.namespace + "-" + env.CLUSTER_NAME
          title: .metadata.name
          blueprint: '"deployment"'
          properties:
            createdAt: .metadata.creationTimestamp
            createdBy: .metadata.annotations."kubectl.kubernetes.io/last-applied-configuration"
            namespace: .metadata.namespace
            replicas: .spec.replicas
            image: .spec.template.spec.containers[0].image

apiVersion: scaffolder.backstage.io/v1beta3
kind: Template
metadata:
  name: deploy-ai-agent
  title: Deploy AI Agent on EKS
  description: Self-service template to deploy an AI agent workload on AWS EKS
  tags:
    - ai
    - eks
    - aws
spec:
  owner: platform-team
  type: service

  parameters:
    - title: Agent Configuration
      required:
        - agentName
        - agentImage
        - namespace
        - awsRegion
        - bedrockModelId
      properties:
        agentName:
          title: Agent Name
          type: string
          description: Unique name for the AI agent
          pattern: "^[a-z][a-z0-9-]{2,30}$"
        agentImage:
          title: Container Image
          type: string
          description: ECR image URI for the agent (e.g., 123456789.dkr.ecr.us-east-1.amazonaws.com/my-agent:latest)
        namespace:
          title: Kubernetes Namespace
          type: string
          description: Target EKS namespace
        awsRegion:
          title: AWS Region
          type: string
          default: us-east-1
          enum:
            - us-east-1
            - us-west-2
            - eu-west-1
        bedrockModelId:
          title: Bedrock Model ID
          type: string
          default: anthropic.claude-3-5-sonnet-20241022-v2:0
          enum:
            - anthropic.claude-3-5-sonnet-20241022-v2:0
            - amazon.nova-pro-v1:0
            - meta.llama3-70b-instruct-v1:0
        replicaCount:
          title: Initial Replicas
          type: integer
          default: 1
          minimum: 1
          maximum: 10
        enableVectorDb:
          title: Enable Vector Database (OpenSearch)
          type: boolean
          default: false

  steps:
    - id: fetch-template
      name: Fetch Agent Template
      action: fetch:template
      input:
        url: ./skeleton
        values:
          agentName: ${{ parameters.agentName }}
          agentImage: ${{ parameters.agentImage }}
          namespace: ${{ parameters.namespace }}
          awsRegion: ${{ parameters.awsRegion }}
          bedrockModelId: ${{ parameters.bedrockModelId }}
          replicaCount: ${{ parameters.replicaCount }}

    - id: create-github-pr
      name: Create GitHub PR with Agent Manifests
      action: publish:github:pull-request
      input:
        repoUrl: github.com?repo=eks-ai-agents&owner=myorg
        title: "feat: deploy ai-agent ${{ parameters.agentName }}"
        branchName: "agent/${{ parameters.agentName }}"
        description: "Automated PR to deploy AI agent ${{ parameters.agentName }} to EKS namespace ${{ parameters.namespace }}"

    - id: create-iam-role
      name: Create IAM Role via AWS CDK
      action: aws:cloudformation:deploy
      input:
        stackName: "ai-agent-${{ parameters.agentName }}-iam"
        templatePath: ./iam/agent-role-template.yaml
        parameters:
          AgentName: ${{ parameters.agentName }}
          BedrockModelId: ${{ parameters.bedrockModelId }}

  output:
    links:
      - title: GitHub PR
        url: ${{ steps['create-github-pr'].output.remoteUrl }}
      - title: View in Backstage
        entityRef: ${{ steps['register'].output.entityRef }}

{
  "identifier": "deploy_ai_agent",
  "title": "Deploy AI Agent on EKS",
  "description": "Self-service action to deploy an AI agent workload to AWS EKS",
  "trigger": {
    "type": "self-service",
    "operation": "CREATE",
    "userInputs": {
      "properties": {
        "agentName": {
          "type": "string",
          "title": "Agent Name",
          "pattern": "^[a-z][a-z0-9-]{2,30}$"
        },
        "agentImage": {
          "type": "string",
          "title": "Container Image URI"
        },
        "namespace": {
          "type": "string",
          "title": "Kubernetes Namespace"
        },
        "bedrockModelId": {
          "type": "string",
          "title": "Bedrock Model ID",
          "enum": [
            "anthropic.claude-3-5-sonnet-20241022-v2:0",
            "amazon.nova-pro-v1:0",
            "meta.llama3-70b-instruct-v1:0"
          ],
          "default": "anthropic.claude-3-5-sonnet-20241022-v2:0"
        },
        "replicaCount": {
          "type": "number",
          "title": "Initial Replicas",
          "default": 1,
          "minimum": 1,
          "maximum": 10
        },
        "enableVectorDb": {
          "type": "boolean",
          "title": "Enable Vector Database",
          "default": false
        }
      },
      "required": ["agentName", "agentImage", "namespace", "bedrockModelId"]
    }
  },
  "invocationMethod": {
    "type": "GITHUB",
    "org": "myorg",
    "repo": "eks-ai-agents",
    "workflow": "deploy-ai-agent.yaml",
    "omitPayload": false,
    "reportWorkflowStatus": true
  }
}

# .github/workflows/deploy-ai-agent.yaml
name: Deploy AI Agent to EKS

on:
  workflow_dispatch:
    inputs:
      port_payload:
        required: true
        description: "Port's payload including action and general context"

jobs:
  deploy-ai-agent:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Parse Port Payload
        id: parse
        run: |
          echo "AGENT_NAME=$(echo '${{ inputs.port_payload }}' | jq -r '.payload.properties.agentName')" >> $GITHUB_ENV
          echo "AGENT_IMAGE=$(echo '${{ inputs.port_payload }}' | jq -r '.payload.properties.agentImage')" >> $GITHUB_ENV
          echo "NAMESPACE=$(echo '${{ inputs.port_payload }}' | jq -r '.payload.properties.namespace')" >> $GITHUB_ENV
          echo "BEDROCK_MODEL=$(echo '${{ inputs.port_payload }}' | jq -r '.payload.properties.bedrockModelId')" >> $GITHUB_ENV
          echo "REPLICAS=$(echo '${{ inputs.port_payload }}' | jq -r '.payload.properties.replicaCount')" >> $GITHUB_ENV
          echo "RUN_ID=$(echo '${{ inputs.port_payload }}' | jq -r '.context.runId')" >> $GITHUB_ENV          

      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: arn:aws:iam::123456789012:role/github-actions-role
          aws-region: us-east-1

      - name: Setup EKS Kubeconfig
        run: |
          aws eks update-kubeconfig --name production-eks --region us-east-1          

      - name: Create Namespace and RBAC
        run: |
          kubectl create namespace $AGENT_NAME --dry-run=client -o yaml | kubectl apply -f -
          kubectl label namespace $AGENT_NAME team=ai-agents environment=production          

      - name: Create IAM Role for Agent (IRSA)
        run: |
          aws iam create-role \
            --role-name ai-agent-$AGENT_NAME \
            --assume-role-policy-document file://iam/trust-policy.json || true
          aws iam attach-role-policy \
            --role-name ai-agent-$AGENT_NAME \
            --policy-arn arn:aws:iam::aws:policy/AmazonBedrockFullAccess          

      - name: Deploy AI Agent to EKS
        run: |
          helm upgrade --install $AGENT_NAME ./charts/ai-agent \
            --namespace $AGENT_NAME \
            --set image=$AGENT_IMAGE \
            --set bedrockModelId=$BEDROCK_MODEL \
            --set replicaCount=$REPLICAS \
            --set serviceAccount.annotations."eks\.amazonaws\.com/role-arn"=arn:aws:iam::123456789012:role/ai-agent-$AGENT_NAME \
            --wait --timeout 5m          

      - name: Update Port Run Status (Success)
        if: success()
        uses: port-labs/port-github-action@v1
        with:
          clientId: ${{ secrets.PORT_CLIENT_ID }}
          clientSecret: ${{ secrets.PORT_CLIENT_SECRET }}
          operation: PATCH_RUN
          runId: ${{ env.RUN_ID }}
          status: SUCCESS
          logMessage: "AI agent ${{ env.AGENT_NAME }} deployed successfully to EKS namespace ${{ env.NAMESPACE }}"

      - name: Update Port Run Status (Failure)
        if: failure()
        uses: port-labs/port-github-action@v1
        with:
          clientId: ${{ secrets.PORT_CLIENT_ID }}
          clientSecret: ${{ secrets.PORT_CLIENT_SECRET }}
          operation: PATCH_RUN
          runId: ${{ env.RUN_ID }}
          status: FAILURE
          logMessage: "Failed to deploy AI agent ${{ env.AGENT_NAME }}"

# terraform/modules/ai-agent-namespace/main.tf

resource "aws_iam_role" "ai_agent" {
  name = "ai-agent-${var.agent_name}"

  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect = "Allow"
      Principal = {
        Federated = "arn:aws:iam::${var.account_id}:oidc-provider/${var.oidc_provider}"
      }
      Action = "sts:AssumeRoleWithWebIdentity"
      Condition = {
        StringEquals = {
          "${var.oidc_provider}:sub" = "system:serviceaccount:${var.agent_name}:${var.agent_name}"
          "${var.oidc_provider}:aud" = "sts.amazonaws.com"
        }
      }
    }]
  })
}

resource "aws_iam_role_policy" "bedrock_access" {
  name = "bedrock-access"
  role = aws_iam_role.ai_agent.id

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Effect   = "Allow"
        Action   = [
          "bedrock:InvokeModel",
          "bedrock:InvokeModelWithResponseStream",
          "bedrock:GetFoundationModel"
        ]
        Resource = "arn:aws:bedrock:${var.aws_region}::foundation-model/${var.bedrock_model_id}"
      },
      {
        Effect   = "Allow"
        Action   = [
          "secretsmanager:GetSecretValue"
        ]
        Resource = "arn:aws:secretsmanager:${var.aws_region}:${var.account_id}:secret:ai-agent/${var.agent_name}/*"
      }
    ]
  })
}

resource "kubernetes_namespace" "agent" {
  metadata {
    name = var.agent_name
    labels = {
      "app.kubernetes.io/managed-by" = "terraform"
      "agent-name"                   = var.agent_name
      "environment"                  = var.environment
    }
  }
}

apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: ai-agent-research-assistant
  namespace: argocd
  labels:
    agent-type: research
spec:
  project: ai-agents
  source:
    repoURL: https://github.com/myorg/eks-ai-agents
    targetRevision: main
    path: agents/research-assistant
    helm:
      valueFiles:
        - values.yaml
        - values-production.yaml
  destination:
    server: https://kubernetes.default.svc
    namespace: research-assistant
  syncPolicy:
    automated:
      prune: true
      selfHeal: true
    syncOptions:
      - CreateNamespace=true

apiVersion: argoproj.io/v1alpha1
kind: ApplicationSet
metadata:
  name: ai-agents
  namespace: argocd
spec:
  generators:
    - git:
        repoURL: https://github.com/myorg/eks-ai-agents
        revision: main
        directories:
          - path: agents/*
  template:
    metadata:
      name: "{{path.basename}}"
    spec:
      project: ai-agents
      source:
        repoURL: https://github.com/myorg/eks-ai-agents
        targetRevision: main
        path: "{{path}}"
      destination:
        server: https://kubernetes.default.svc
        namespace: "{{path.basename}}"
      syncPolicy:
        automated:
          prune: true
          selfHeal: true
        syncOptions:
          - CreateNamespace=true

# charts/ai-agent/values.yaml
replicaCount: 1

image:
  repository: ""
  tag: "latest"
  pullPolicy: IfNotPresent

serviceAccount:
  create: true
  annotations: {}

bedrockModelId: "anthropic.claude-3-5-sonnet-20241022-v2:0"
awsRegion: "us-east-1"

resources:
  requests:
    memory: "512Mi"
    cpu: "250m"
    nvidia.com/gpu: "0"
  limits:
    memory: "2Gi"
    cpu: "2000m"

autoscaling:
  enabled: true
  provider: keda  # keda or hpa
  keda:
    triggers:
      - type: aws-sqs-queue
        metadata:
          queueURL: "https://sqs.us-east-1.amazonaws.com/123456789012/ai-agent-tasks"
          queueLength: "5"
          awsRegion: "us-east-1"
          identityOwner: pod

env:
  - name: BEDROCK_MODEL_ID
    value: "{{ .Values.bedrockModelId }}"
  - name: AWS_DEFAULT_REGION
    value: "{{ .Values.awsRegion }}"

secrets:
  - name: AGENT_API_KEY
    secretName: "ai-agent-secrets"
    secretKey: "api-key"

persistence:
  enabled: false
  storageClass: "gp3"
  size: "10Gi"

monitoring:
  enabled: true
  serviceMonitor: true
  prometheusRule: true

apiVersion: keda.sh/v1alpha1
kind: ScaledObject
metadata:
  name: research-assistant-scaler
  namespace: research-assistant
spec:
  scaleTargetRef:
    name: research-assistant
  pollingInterval: 15
  cooldownPeriod: 300
  minReplicaCount: 0
  maxReplicaCount: 20
  triggers:
    - type: aws-sqs-queue
      authenticationRef:
        name: keda-aws-credentials
      metadata:
        queueURL: "https://sqs.us-east-1.amazonaws.com/123456789012/research-tasks"
        queueLength: "5"
        awsRegion: us-east-1
        identityOwner: pod

apiVersion: v1
kind: ConfigMap
metadata:
  name: otel-collector-config
  namespace: observability
data:
  config.yaml: |
    receivers:
      otlp:
        protocols:
          grpc:
            endpoint: 0.0.0.0:4317
          http:
            endpoint: 0.0.0.0:4318

    processors:
      batch:
        timeout: 10s
      resource:
        attributes:
          - action: insert
            key: cloud.provider
            value: aws
          - action: insert
            key: cloud.platform
            value: aws_eks

    exporters:
      otlp/datadog:
        endpoint: https://trace.agent.datadoghq.com
        headers:
          DD-API-KEY: "${DD_API_KEY}"
      awsxray:
        region: us-east-1
      debug:
        verbosity: normal

    service:
      pipelines:
        traces:
          receivers: [otlp]
          processors: [batch, resource]
          exporters: [otlp/datadog, awsxray]    

apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: research-assistant-secrets
  namespace: research-assistant
spec:
  refreshInterval: 1h
  secretStoreRef:
    name: aws-secretsmanager
    kind: ClusterSecretStore
  target:
    name: research-assistant-secrets
    creationPolicy: Owner
  data:
    - secretKey: openai-api-key
      remoteRef:
        key: ai-agents/research-assistant
        property: openai_api_key
    - secretKey: pinecone-api-key
      remoteRef:
        key: ai-agents/research-assistant
        property: pinecone_api_key