GOOGLE CLOUD → STACKIT · COMPLETE GUIDE
The complete Google Cloud to STACKIT migration guide
Start with an assessment of your Google Cloud Terraform, not with a migration. StackToIT reads the code, classes every resource, drafts STACKIT Terraform where it can and lists what a person must decide. This guide follows the order that work takes: scope, assessment, landing zone, network, workloads, data, identity and cutover.
The migration in ten steps
Where the run holds the answer, the step names the file. Steps marked as practice are general advice, not output of the run.
1. Collect the Terraform and pin the provider
Gather the root modules of every project and commit the .terraform.lock.hcl. In the example runs, a Google provider without a lock file caps every unit at medium confidence, and the source cannot be validated with OpenTofu, because the validation never installs a provider without a lock file.
2. Run the assessment
Run stacktoit assess ./gcp-terraform. It reads Terraform and OpenTofu root modules that use the Google provider and does not connect to a Google Cloud project.
3. Read the results in order
Open index.html first, then assessment.json for each unit’s class and reason, decisions.json and the input templates for open choices, then target-plan.json, terraform/ and execution/.
4. Design the landing zone
Decide how folders and projects map and whether a Shared VPC becomes a Network Area. The run classes the Shared VPC link as a redesign.
5. Rebuild the network
Subnetworks become STACKIT networks and firewall rules become security groups. Deny rules, tag selectors and a fixed NAT address need decisions.
6. Move compute and containers
GKE becomes SKE, Compute Engine becomes Compute Engine, and Cloud Run and Cloud Functions become workloads on SKE or Cloud Foundry apps.
7. Plan the data
Cloud SQL moves to PostgreSQL Flex, MariaDB or SQLServer Flex; Cloud Storage to Object Storage. BigQuery, Spanner and Bigtable need a design, not a copy.
8. Translate identity and secrets
Service accounts become STACKIT service accounts, and secrets are recreated in Secrets Manager. GKE Workload Identity does not carry over as such: the run points to a STACKIT service account with a federated identity provider that trusts the SKE cluster’s issuer, created per Kubernetes service account.
9. Fill in the decisions and run again
Answer inputs-template.yaml and decisions-template.yaml and run again with --inputs and --decisions. Inputs can change the draft; a recorded decision review alone does not rewrite the Terraform, so check the new execution plan after every change.
10. Copy, cut over, verify (practice)
Choose a data-movement mechanism per data unit, agree windows, switch consumers, verify, and keep the source until acceptance. The run lists the units and the decisions; people and tools do the moving.
The service map
The curated mapping StackToIT applies to Google Cloud, with the class it usually carries. The class of a given resource depends on its configuration and is stated in your run.
| Google Cloud | STACKIT target | Usual class |
|---|---|---|
| Compute Engine | STACKIT Compute Engine | Reconfigure |
| Google Kubernetes Engine | STACKIT Kubernetes Engine (SKE) | Replatform |
| Cloud SQL | PostgreSQL Flex, MariaDB, SQLServer Flex | Replatform |
| AlloyDB | PostgreSQL Flex | Replatform |
| Cloud Storage | STACKIT Object Storage | Reconfigure |
| Memorystore for Redis | Key Value Store (Valkey) | RECONFIGURE or REPLATFORM |
| Pub/Sub | STACKIT RabbitMQ | Replatform |
| Cloud Run | SKE or Cloud Foundry | Containerize |
| BigQuery | Lakehouse on Object Storage, or a self-managed warehouse | Redesign |
| Spanner | PostgreSQL Flex, or self-managed distributed SQL | Redesign |
| Bigtable | Self-managed wide-column store on SKE, or MongoDB Flex | Redesign |
The deeper pages of this guide cover networking, landing zones, Cloud Functions, Cloud Run, Cloud SQL and GKE.
A GKE cluster, converted
From the existing GKE run on an estate written for these pages, assessed by StackToIT on 4 November 2026: a regional cluster with Workload Identity and a node pool. Left: the cluster of the input. Right: the block of the STACKIT Terraform the run wrote; the review comments above the block are left out here.
resource "google_container_cluster" "platform" {
name = "platform"
location = "europe-west3"
network = google_compute_network.platform.id
subnetwork = google_compute_subnetwork.gke.id
min_master_version = "1.32"
remove_default_node_pool = true
initial_node_count = 1
deletion_protection = true
release_channel {
channel = "REGULAR"
}
workload_identity_config {
workload_pool = "shop-platform-prod.svc.id.goog"
}
}resource "stackit_ske_cluster" "platform" {
project_id = var.project_id
name = "platform"
node_pools = [{
name = "general"
machine_type = var.general_machine_type
minimum = var.platform_general_minimum
maximum = var.platform_general_maximum
availability_zones = var.availability_zones
}]
kubernetes_version_min = "1.36"
lifecycle {
prevent_destroy = true
}
}Version is raised, not copied
The source runs Kubernetes 1.32. The draft sets kubernetes_version_min to 1.36, four minor versions higher, and tells you to check manifests and Helm charts for removed APIs before the move.
Release channels do not exist
SKE has no release channels; automatic updates are a maintenance setting.
Network and identity are left to you
The cluster is not placed into a generated network: without a Network Area network SKE creates the cluster’s own network. The Google workload pool does not carry over either. Both are named in the file.
What the example runs tell you
Figures from the runs on the example estates of these pages, not from your estate.
Kubernetes moves
A GKE estate of 4 units produced a drafted SKE cluster, a network and a service account, with no unit left to the architect.
Databases change shape
Cloud SQL for PostgreSQL maps to PostgreSQL Flex, and a MySQL instance maps to STACKIT MariaDB. Private-IP-only databases have no counterpart, so the endpoint scope becomes a decision.
Serverless becomes platform work
A Cloud Run service and a Cloud Function both map to CONTAINERIZE: the image or code moves and the platform around it is drafted.
The network needs the most decisions
In the network example, the egress deny rule is a redesign and a fixed NAT address is not kept.
Decisions the architect owns
Open items that appear in the runs across all of these estates.
Project and folder mapping
The draft places everything in one project and region. Decide the real layout before you apply.
Cluster placement
The SKE cluster is not placed into a generated network. Decide whether it joins a Network Area.
Node pool sizes
GKE counts the minimum and maximum of a node pool per zone, SKE counts the whole pool. The GKE run copies no value as equivalent and asks you to set the pool totals.
Database reachability
Decide the endpoint scope and the allowed ranges for every database that was private on Google Cloud. Left unset, the STACKIT API makes the endpoint public, so list the clients in the allowed-ranges variable before you apply.
Data-movement mechanism
The run records each data unit as a decision with no mechanism chosen. Pick one per unit, with a downtime tolerance and a recovery point.
Identity model
Decide who may use each STACKIT service account and how workloads authenticate without a metadata server.
Redesign units
For BigQuery, Spanner and Bigtable, decide the target design first; classification as REDESIGN means no automated draft stands in for it.
Questions migration leads ask
Where do I start a Google Cloud to STACKIT migration?
With an assessment of your Terraform. It tells you which resources move directly, which change platform and which need a redesign, before you commit to a plan.
Does StackToIT connect to our Google Cloud project?
No. It reads Terraform and OpenTofu root modules and writes files. Nothing is changed in any cloud, and generated scripts are run by people.
Which Google Cloud services are hardest to move?
BigQuery, Spanner and Bigtable. They map to REDESIGN because the target is a design decision, a lakehouse or a different database, not a like-for-like service.
Is the generated Terraform ready to apply?
No. It is a draft for architect review. The example runs report that none of their automated steps could run as written until decisions and values were supplied.
Sources
Your next move: STACKIT.
Tell us about your estate. We show you what StackToIT delivers for it: target architecture, Terraform artifacts and a structured migration plan.