Ein Huawei-Cloud-Webshop auf STACKIT: Fallstudie einer vollständigen Bewertung

resource "huaweicloud_vpc_eip" "web" {
  publicip {
    type = "5_bgp"
  }
  bandwidth {
    share_type  = "PER"
    name        = "shop-web"
    size        = 20
    charge_mode = "traffic"
  }
}

resource "huaweicloud_lb_loadbalancer" "web" {
  name          = "shop-lb"
  vip_subnet_id = huaweicloud_vpc_subnet.app.ipv4_subnet_id
}

{
  "id": "huaweicloud_vpc_eip.web",
  "result": {
    "class": "RECONFIGURE",
    "confidence": "MEDIUM",
    "target": {
      "service": "STACKIT public IP"
    },
    "reason": "An EIP becomes a STACKIT public IP. The address itself changes, so DNS records and allow lists that name it change too."
  }
}

{
  "id": "huaweicloud_lb_loadbalancer.web",
  "result": {
    "class": "RECONFIGURE",
    "confidence": "MEDIUM",
    "target": {
      "service": "STACKIT Network Load Balancer"
    },
    "reason": "A shared load balancer becomes a STACKIT Network Load Balancer. Listeners and backends are rewritten, and the public address changes."
  }
}

resource "huaweicloud_rds_instance" "db" {
  name              = "shop-db"
  flavor            = "rds.pg.n1.xlarge.2"
  vpc_id            = huaweicloud_vpc.shop.id
  subnet_id         = huaweicloud_vpc_subnet.data.id
  security_group_id = huaweicloud_networking_secgroup.web.id
  availability_zone = ["eu-west-101a"]

  db {
    type    = "PostgreSQL"
    version = "15"
  }

  volume {
    type = "CLOUDSSD"
    size = 200
  }
}

resource "huaweicloud_dcs_instance" "sessions" {
  name               = "shop-sessions"
  engine             = "Redis"
  engine_version     = "6.0"
  capacity           = 4
  flavor             = "redis.ha.xu1.large.r2.4"
  availability_zones = ["eu-west-101a", "eu-west-101b"]
  password           = var.redis_password
  vpc_id             = huaweicloud_vpc.shop.id
  subnet_id          = huaweicloud_vpc_subnet.data.id
}

{
  "id": "huaweicloud_rds_instance.db",
  "result": {
    "class": "REPLATFORM",
    "confidence": "MEDIUM",
    "target": {
      "service": "STACKIT PostgreSQL Flex"
    },
    "reason": "Managed PostgreSQL to managed PostgreSQL: data moves with pg_dump/pg_restore or logical replication, and the flavor becomes a Flex flavor."
  }
}

{
  "id": "huaweicloud_dcs_instance.sessions",
  "result": {
    "class": "RECONFIGURE",
    "confidence": "MEDIUM",
    "target": {
      "service": "STACKIT Key Value Store (Valkey)"
    },
    "reason": "A DCS instance becomes a Valkey instance. The application changes its endpoint and credentials; check the engine and version in use, since a Memcached instance needs a client change."
  }
}

resource "huaweicloud_networking_secgroup" "web" {
  name        = "shop-web"
  description = "Web tier"
}

resource "huaweicloud_networking_secgroup_rule" "https" {
  security_group_id = huaweicloud_networking_secgroup.web.id
  direction         = "ingress"
  ethertype         = "IPv4"
  protocol          = "tcp"
  ports             = "443"
  remote_ip_prefix  = "0.0.0.0/0"
}

{
  "id": "huaweicloud_networking_secgroup.web",
  "result": {
    "class": "RECONFIGURE",
    "confidence": "LOW",
    "reason": "A security group becomes a STACKIT security group. STACKIT rules only allow traffic, so a deny rule or a priority order of the source needs a decision.",
    "findings": [
      {
        "check_id": "uncatalogued-related",
        "severity": "warning",
        "message": "huaweicloud_networking_secgroup_rule.https (huaweicloud_networking_secgroup_rule) is linked to this unit; the knowledge base catalogues it but has no mapping rule, semantic contract or criticality row for it (catalogued but unmapped), so what it does to this unit is not assessed."
      }
    ]
  }
}

## Wave 1 — 6 unit(s)

| Unit | Class | Target |
|---|---|---|
| `huaweicloud_dns_recordset.www` | RECONFIGURE / MEDIUM | STACKIT DNS |
| `huaweicloud_kms_key.shop` | RECONFIGURE / MEDIUM | STACKIT KMS |
| `huaweicloud_networking_secgroup.web` | RECONFIGURE / LOW | STACKIT security groups |
| `huaweicloud_obs_bucket.media` | RECONFIGURE / MEDIUM | STACKIT Object Storage |
| `huaweicloud_vpc.shop` | RECONFIGURE / MEDIUM | STACKIT network |
| `huaweicloud_vpc_eip.web` | RECONFIGURE / MEDIUM | STACKIT public IP |

## Wave 2 — 3 unit(s)

| Unit | Class | Target |
|---|---|---|
| `huaweicloud_csms_secret.db` | RECONFIGURE / MEDIUM | STACKIT Secrets Manager |
| `huaweicloud_vpc_subnet.app` | RECONFIGURE / MEDIUM | STACKIT network |
| `huaweicloud_vpc_subnet.data` | RECONFIGURE / MEDIUM | STACKIT network |

## Wave 3 — 5 unit(s)

| Unit | Class | Target |
|---|---|---|
| `huaweicloud_cce_cluster.jobs` | REPLATFORM / MEDIUM | STACKIT Kubernetes Engine (SKE) |
| `huaweicloud_compute_instance.web` | RECONFIGURE / MEDIUM | STACKIT Compute Engine |
| `huaweicloud_dcs_instance.sessions` | RECONFIGURE / MEDIUM | STACKIT Key Value Store (Valkey) |
| `huaweicloud_lb_loadbalancer.web` | RECONFIGURE / MEDIUM | STACKIT Network Load Balancer |
| `huaweicloud_rds_instance.db` | REPLATFORM / MEDIUM | STACKIT PostgreSQL Flex |

| Package | Owner | Phase | Steps | Resources | Decisions to answer | State |
|---|---|---|---|---|---|---|
| [`WP-01`](manual/actions.md) Set up by hand the resources the draft writes nothing for (foundation) | Network Architect | foundation | 3 | 3 | — | a person can start it now |
| [`WP-02`](manual/actions.md) Set up by hand the resources the draft writes nothing for (security) | Network Architect | security | 1 | 1 | — | a person can start it now |
| [`WP-03`](manual/actions.md) Set up by hand the resources the draft writes nothing for (security) | Owner assignment required | security | 2 | 2 | — | a person can start it now |
| [`WP-04`](manual/actions.md) Set up by hand the resources the draft writes nothing for (data services) | Data Architect | data services | 2 | 2 | — | a person can start it now |
| [`WP-05`](manual/actions.md) Set up by hand the resources the draft writes nothing for (data services) | Storage Architect | data services | 1 | 1 | — | a person can start it now |
| [`WP-06`](manual/actions.md) Set up by hand the resources the draft writes nothing for (platform services) | Network Architect | platform services | 1 | 1 | — | a person can start it now |
| [`WP-07`](manual/actions.md) Set up by hand the resources the draft writes nothing for (platform services) | Platform Architect | platform services | 1 | 1 | — | a person can start it now |
| [`WP-08`](manual/actions.md) Set up by hand the resources the draft writes nothing for (workloads) | Network Architect | workloads | 1 | 1 | — | a person can start it now |
| [`WP-09`](manual/actions.md) Set up by hand the resources the draft writes nothing for (workloads) | Platform Architect | workloads | 1 | 1 | — | a person can start it now |
| [`WP-10`](manual/actions.md) Carry out the cutover steps | Network Architect | cutover | 1 | 1 | — | a person can start it now |