Google Compute Engine to STACKIT Compute, step by step

Step 1: the VM becomes a server

The demo estate is six resources written for this page and assessed by StackToIT on 4 November 2026. Left: the instance as the input declares it. Right: the server and network interface the engine wrote; the review comments above each block in the file are left out here.

resource "google_compute_instance" "web" {
  name         = "web-01"
  machine_type = "n2-standard-4"
  zone         = "europe-west3-a"
  tags         = ["web"]

  boot_disk {
    initialize_params {
      image = "debian-cloud/debian-12"
      size  = 50
      type  = "pd-balanced"
    }
  }

  attached_disk {
    source = google_compute_disk.data.id
  }

  network_interface {
    subnetwork = google_compute_subnetwork.web.id
    access_config {
      nat_ip = google_compute_address.web.address
    }
  }

  metadata = {
    enable-oslogin = "TRUE"
  }
}

resource "stackit_network_interface" "web_1" {
  project_id = var.project_id
  network_id = stackit_network.web.network_id
}

resource "stackit_server" "web" {
  project_id        = var.project_id
  name              = "web-01"
  machine_type      = var.web_machine_type
  availability_zone = var.availability_zone
  boot_volume = {
    source_type           = "image"
    source_id             = var.web_image_id
    size                  = 50
    delete_on_termination = true
  }
  network_interfaces = [stackit_network_interface.web_1.network_interface_id]
}

• Machine type and image are variables

  The draft does not guess a flavour or an image. web_machine_type has no default; the variable description reads n2-standard-4 as roughly 4 vCPU and 16 GiB. STACKIT lists g2i.4 as a general purpose type with 4 vCPU and 16 GB, so that is a natural candidate, but the choice is yours. web_image_id takes a public image or one you upload.

• Zone, boot disk type and tags do not carry over

  The server is created in var.availability_zone, default eu01-1. The boot disk type pd-balanced has no equivalent: a STACKIT boot volume takes an image, a size and a performance class. The network tag web is turned into a security group, covered in step 2.

• Boot volume deletion follows the source

  Google deletes the boot disk with the instance when auto-delete is unset. The draft sets delete_on_termination = true to match, and says so in a comment.

Step 2: disk, firewall rule and external address

From the same run. First pane: the firewall rule and the data disk, in file order. Then the volume (terraform/compute.tf) and the security group with the first of its two rules (terraform/security.tf) (the second, for port 443, has the same shape); as in step 1, the review comments above each block are left out.

resource "google_compute_firewall" "web_ingress" {
  name          = "allow-web"
  network       = google_compute_network.app.name
  direction     = "INGRESS"
  source_ranges = ["0.0.0.0/0"]
  target_tags   = ["web"]

  allow {
    protocol = "tcp"
    ports    = ["80", "443"]
  }
}

resource "google_compute_disk" "data" {
  name = "web-data"
  type = "pd-ssd"
  zone = "europe-west3-a"
  size = 200
}

resource "stackit_volume" "data" {
  project_id        = var.project_id
  name              = "web-data"
  availability_zone = var.availability_zone
  size              = 200
  performance_class = var.data_performance_class
}

resource "stackit_security_group" "web_ingress" {
  project_id = var.project_id
  name       = "allow-web"
}

resource "stackit_security_group_rule" "web_ingress_allow_web" {
  project_id        = var.project_id
  security_group_id = stackit_security_group.web_ingress.security_group_id
  direction         = "ingress"
  ether_type        = "IPv4"
  ip_range          = "0.0.0.0/0"
  port_range = {
    max = 80
    min = 80
  }
  protocol = {
    name = "tcp"
  }
}

• A performance class replaces pd-ssd

  The volume takes var.data_performance_class. STACKIT Block Storage offers storage_premium_perf classes from perf0 (120 IOPS, 25 MB/s) up to perf29 (60,000 IOPS, 1,500 MB/s), independent of volume size. Pick the class from the measured load of the source disk, not from its name.

• Size 200 is copied, the unit is yours to check

  The run copies 200 unchanged and notes that STACKIT's documentation does not say whether its GB is GiB. Check the unit on the target before the data is copied.

• The rule is written, the attachment to the VM is not

  The engine writes the security group and one rule per port, but it does not decide which network interfaces list the group: the source selected instances by the tag web, and STACKIT has no tag selector. It also records that GCP rule priority is not carried and that an organisation or folder policy outside the scan may have restricted the source further.

• Two attachments you add yourself

  The assessment names stackit_server_volume_attach and stackit_public_ip_associate as targets, but this run's Terraform contains neither block: the volume is not attached to the server and the address is not bound to its interface. Add both after the server exists; the provider documents server_id and volume_id for the volume attachment, and the run notes that stackit_public_ip itself takes a network_interface_id. stackit_public_ip has no name attribute, so web-ip survives only as the Terraform label.

What the run decided for the six resources

Classes as assessment.json records them: five RECONFIGURE, one DIRECT, confidence MEDIUM on every unit. The run orders them in three waves: address, disk and network first; firewall and subnet second; the instance last, because it depends on all of them.

Step 3: move the machine and its data

StackToIT never moves data. The run lists the data disk as a stateful unit with the mechanism left open (migration/data-movement.md), so these steps are practice for you to choose from.

1. 01

   Decide: rebuild or carry the image

   A VM that is configuration plus a data disk is usually rebuilt on a public Debian image (STACKIT provides Debian, Ubuntu and other distributions) and configured again with your own tooling. A VM with state on its boot disk can be exported.

2. 02

   Export the image

   Export works on images, not on instances: first create a custom image from the boot disk or from a snapshot of it, and Google advises stopping the VM so nothing writes to the disk meanwhile. gcloud compute images export then writes a tar.gz archive with disk.raw to Cloud Storage; --export-format also offers vmdk, vhdx, vpc, vdi and qcow2. Only images you created or imported can be exported.

3. 03

   Import it as a STACKIT image

   The provider's stackit_image resource takes a disk_format and a local_file_path, so a qcow2 file can be uploaded from your workstation. STACKIT's own page calls the older Infrastructure API route deprecated, so use the provider or the portal.

4. 04

   Copy the data disk

   Attach the new volume, then copy file systems with rsync or a block copy, depending on whether the application can stop. Time the final sync inside the cutover window.

5. 05

   Check the order before apply

   Variables without a default (project_id, machine type, image) must have a value first. execution/verify/checks.md lists a check before and after each step.

What to change before applying

• Machine type, image and boot size

  Set web_machine_type and web_image_id; the boot volume size of 50 is copied from the source.

• Security group attachment

  List stackit_security_group.web_ingress on the interfaces that carried the tag web, and on no others.

• Open source range

  The two rules open port 80 and port 443 to every address, as the source did. Decide whether a load balancer or a narrower range belongs in front.

• Private DNS names

  The Google resolver answers internal host names. The drafted network uses STACKIT's default name servers, which resolve public names only.

• Provider pin

  The source declares google 8.4.0 without a lock file, so the run caps confidence at MEDIUM. Commit the lock file and run again.

Questions platform teams ask

Sources

• Google Cloud: Export an image to Cloud Storage
• Google Cloud: Create a custom image from a disk
• Google Cloud: VPC firewall rules
• STACKIT: Server machine types
• STACKIT: Block Storage service plans
• STACKIT: Operating system images
• STACKIT Terraform provider v0.121.0: stackit_image