While CNOE allows for swapping components, its reference implementation standardizes on a specific set of tools. Understanding why each tool was chosen — not just what it does — is what separates a practitioner from someone who has only read the documentation.
1. The Interface: Backstage
Backstage is the developer-facing layer — the single pane of glass where developers discover services, create new projects from templates, read documentation, and check deployment status. It was built by Spotify and donated to the CNCF.
CNOE standardizes on Backstage because it is the only developer portal with a mature plugin ecosystem and a well-defined data model (the Software Catalog). Critically, Backstage integrates with every other tool in the CNOE stack: it can display ArgoCD sync status, trigger Crossplane provisioning workflows, and authenticate users via Keycloak.
2. The Engine: ArgoCD (GitOps)
ArgoCD is the GitOps controller. It watches Git repositories for changes to Kubernetes manifests and automatically applies those changes to the cluster. If someone manually modifies a resource in the cluster (drift), ArgoCD detects it and reverts to the Git-declared state.
CNOE chooses ArgoCD over alternatives like Flux because of its mature UI, its ApplicationSet controller (which enables multi-cluster, multi-tenant deployments from a single configuration), and its deep integration with Backstage via the ArgoCD plugin.
3. The Provisioner: Crossplane
This is the most architecturally significant choice in the CNOE stack. Crossplane is a Kubernetes operator that extends the Kubernetes API to manage cloud infrastructure — AWS RDS instances, S3 buckets, GCP Cloud SQL databases — using standard Kubernetes YAML manifests.
The key insight: with Crossplane, infrastructure provisioning uses the same workflow as application deployment. ArgoCD can sync a PostgreSQLInstance custom resource the same way it syncs a Deployment. There is no separate Terraform pipeline, no separate state management, no separate access control system. Everything flows through the Kubernetes API.
Crossplane also introduces Compositions — a mechanism where platform teams define how a resource is provisioned (which cloud, which configuration, which security settings), while developers only specify what they need (a database with 100GB storage). This enforces the separation of concerns between platform and application teams.
4. Identity: Keycloak
Keycloak is an open-source Identity and Access Management (IAM) server. It implements OpenID Connect (OIDC) and SAML 2.0, making it the central authentication authority for the entire platform.
In a CNOE deployment, Keycloak issues tokens that are trusted by Backstage, ArgoCD, and the Kubernetes API server itself. A developer logs in once to Keycloak and gets access to all platform tools based on their group membership — no separate accounts, no shared passwords.
A common interview question is: "Why would you use Keycloak instead of just using your cloud provider's IAM?" The answer is portability and unification. Cloud IAM (AWS IAM, GCP IAM) is excellent for cloud resource access but does not natively provide SSO for application-layer tools like Backstage or ArgoCD. Keycloak federates your existing identity provider (Active Directory, Okta, Google Workspace) and issues OIDC tokens that every tool in the stack can validate — regardless of which cloud you are on.