Execution Contracts in Platform Engineering

Powering True Self-Service with Backstage + Crossplane

Modern platform engineering isn’t about building tools—it’s about standardizing how infrastructure and services are consumed.
The biggest gap most organizations face is not tooling, but alignment between developer intent and platform execution.
This is where the concept of an Execution Contract becomes transformative.

What is an Execution Contract?

An Execution Contract is a declarative, versioned agreement between platform teams and developers that defines:

• What developers can request (inputs)
• What the platform guarantees (outputs)
• How the system behaves (policies, constraints, workflows)

Think of it as:

“A productized API for platform capabilities, not just infrastructure.”

Why Execution Contracts Matter

Without execution contracts:

• Developers rely on tribal knowledge or tickets
• Infrastructure becomes inconsistent
• Security and compliance drift over time
• Self-service becomes “self-confusion”

With execution contracts:

• Everything is standardized and reproducible
• Developers get clear boundaries and expectations
• Platform teams enforce guardrails by design
• Workflows become fully automated

Core Principles of Execution Contracts

1. Declarative Intent

Developers define what they want, not how to build it.

apiVersion: platform.io/v1
kind: ServiceInstance
spec:
  type: postgres
  size: small
  region: ap-south-1

2. Abstraction over Infrastructure

No direct exposure to cloud primitives like VPCs, subnets, or IAM roles.
Instead:

• “Postgres DB”
• “Internal API Service”
• “Event Streaming Cluster”

3. Policy-Driven Guardrails

Execution contracts embed:

• Security policies
• Naming conventions
• Cost controls
• Compliance requirements

4. Versioning & Evolution

Contracts evolve safely:

• v1alpha1 → v1beta1 → v1
• Backward compatibility is maintained

5. Observable Outcomes

The contract defines expected outputs:

• Connection endpoints
• Credentials
• Health status
• Metrics hooks

Enter Backstage + Crossplane

Execution contracts become powerful when backed by the right control plane.

Backstage → Developer Experience Layer

Crossplane → Infrastructure Control Plane

Together, they create a closed-loop platform workflow.

Architecture Overview

Developer → Backstage → Execution Contract → Crossplane → Cloud Resources
                      ↓
                 Observability + Status Feedback

Role of Backstage

Backstage acts as the front door of the platform.

1. Software Templates as Contracts

Backstage templates define:

• Input forms (developer-friendly UI)
• Validation rules
• Default configurations Example:

parameters:
  - title: Database Configuration
    properties:
      dbType:
        type: string
        enum: [postgres, mysql]
      size:
        type: string
        enum: [small, medium, large]

This becomes the UI representation of the execution contract.

2. Golden Paths

Backstage enforces:

• Standard service creation flows
• Pre-approved architectures
• Opinionated best practices

3. Metadata & Catalog Integration

Every contract execution results in:

• A registered service
• Ownership tracking
• Lifecycle visibility

Role of Crossplane

Crossplane is where the execution contract becomes real infrastructure.

1. Composite Resources (XRs)

Execution contracts map directly to Crossplane Composite Resource Definitions (XRDs).

Example:

apiVersion: apiextensions.crossplane.io/v1
kind: CompositeResourceDefinition
metadata:
  name: xdatabases.platform.io
spec:
  group: platform.io
  names:
    kind: XDatabase
  versions:
    - name: v1alpha1

2. Composition = Implementation of Contract

Compositions define:

• How resources are provisioned
• Which cloud services are used
• How components are wired together

Example:

• AWS RDS
• Security Groups
• Secrets Manager

All hidden behind a single contract.

3. Multi-Cloud Abstraction

Crossplane allows:

• AWS / Azure / GCP behind same contract
• Zero change for developers

4. Policy Enforcement

Using:

• Composition patches
• OPA/Gatekeeper integration You enforce:
• Encryption
• Network isolation
• Backup policies

End-to-End Workflow

Let’s walk through a real platform flow.

Step 1: Developer Requests a Service

From Backstage UI:

• Select “Create Database”
• Fill form (size, region, type)

Step 2: Contract is Generated

Backstage produces a manifest:

apiVersion: platform.io/v1
kind: XDatabase
spec:
  engine: postgres
  size: small

Step 3: Crossplane Reconciliation

Crossplane:

• Picks up the resource
• Applies composition
• Provisions cloud infrastructure

Step 4: Outputs are Published

Backstage updates:

• DB endpoint
• Credentials (via secrets)
• Status (Ready / Failed)

Step 5: Continuous Reconciliation

Crossplane ensures:

• Drift correction
• Policy compliance
• Lifecycle management

Key Benefits of This Model

🚀 True Self-Service

No tickets. No waiting. Instant provisioning.

🔒 Built-in Governance

Security and compliance are part of the contract—not an afterthought.

🔁 Repeatability at Scale

Every environment is consistent.

🌍 Multi-Cloud Portability

Same contract → different cloud providers.

📦 Platform as a Product

Execution contracts become:

• Reusable
• Discoverable
• Versioned

Advanced Patterns

1. Contract Composition Layers

You can stack contracts:

• XService → uses XDatabase + XCache
• Builds full application stacks

2. Policy as Code Integration

Integrate:

• OPA
• Kyverno

To enforce contract-level constraints.

3. GitOps Integration

Execution contracts can be:

• Stored in Git
• Applied via ArgoCD / Flux

4. SPIFFE/SPIRE Identity Integration

Attach identity to contracts:

• Automatic workload identity
• Secure service-to-service auth

Common Pitfalls

❌ Overexposing Infrastructure

Avoid leaking low-level configs into contracts.

❌ Too Many Variants

Keep contracts opinionated, not overly flexible.

❌ Lack of Versioning Strategy

Breaking changes can disrupt developers.

Final Thought

Execution contracts redefine platform engineering:

From “providing infrastructure” → to “delivering reliable, consumable platform products”

With Backstage + Crossplane:

• Backstage defines the experience and interface

• Crossplane executes the contract and lifecycle

Together, they enable:

A fully self-service, policy-driven, developer-first platform