HUAWEI CLOUD → STACKIT · CASE STUDY
A Huawei Cloud web shop on STACKIT: full assessment case study
One realistic estate, assessed end to end: a web shop with a server, a load balancer, a public address, a PostgreSQL database, a session cache, object storage, a key, a secret, DNS and a small Kubernetes cluster for background jobs. 15 Terraform resources became 14 units in three waves, 12 RECONFIGURE and 2 REPLATFORM. This walkthrough shows each figure, the excerpts that matter and the decisions that stay with your architects.
The estate and its result
Assessed by StackToIT on 4 November 2026 from one Terraform file and one variable file with placeholder values. Each row is a unit; the wave is the order in which its dependencies allow it to move.
| Huawei Cloud resource (wave) | STACKIT target | Class and confidence |
|---|---|---|
| VPC (1) | STACKIT network | RECONFIGURE, MEDIUM |
| Subnets app and data (2) | STACKIT networks with their own ranges | RECONFIGURE, MEDIUM |
| Security group (1) | STACKIT security group | RECONFIGURE, LOW |
| ECS web server (3) | STACKIT server, volume and network interface | RECONFIGURE, MEDIUM |
| EIP (1) | STACKIT public IP | RECONFIGURE, MEDIUM |
| Shared load balancer (3) | STACKIT Network Load Balancer | RECONFIGURE, MEDIUM |
| RDS for PostgreSQL (3) | STACKIT PostgreSQL Flex | REPLATFORM, MEDIUM |
| DCS Redis sessions (3) | STACKIT Key Value Store (Valkey) | RECONFIGURE, MEDIUM |
| OBS bucket (1) | STACKIT Object Storage | RECONFIGURE, MEDIUM |
| KMS key (1) and CSMS secret (2) | STACKIT KMS and Secrets Manager | RECONFIGURE, MEDIUM |
| DNS record set (1) | Record in a STACKIT DNS zone | RECONFIGURE, MEDIUM |
| CCE cluster (3) | STACKIT Kubernetes Engine (SKE) | REPLATFORM, MEDIUM |
The security group rule is part of the group’s unit, which is why 15 resources give 14 units. Nothing is classified REDESIGN, BLOCKED or MANUAL_REVIEW.
The figures of the run
15 resources, 14 units
One file read, no module missed, 13 dependencies between units. The source status is COMPLETE because the variable file supplied the two sensitive values.
12 and 2
12 units are RECONFIGURE: the service exists on STACKIT and its settings change. 2 are REPLATFORM: the database and the Kubernetes cluster move to a different platform model.
13 MEDIUM, 1 LOW
No unit is HIGH. The provider is not pinned by a lock file, which the run states, and the LOW unit is the security group, explained below.
3 waves: 6, 3 and 5 units
Wave 1 holds what depends on nothing, wave 2 the subnets and the secret that names the key, wave 3 everything that sits in the network.
10 work packages, 14 manual steps
For a Huawei Cloud source this build writes no STACKIT resource blocks. All 14 units are manual steps that a person can start now, grouped by phase and owner.
1 blocking question
The target region, eu01 or eu02. Four further requests (STACKIT project, observability, public ingress and egress) are recorded by this build without changing the draft; you set them in the target environment.
The web tier: address and load balancer
The address and the load balancer are the two units whose result changes what the outside world sees. The two input panes are two separate resource blocks from main.tf, each shown in full.
resource "huaweicloud_vpc_eip" "web" {
publicip {
type = "5_bgp"
}
bandwidth {
share_type = "PER"
name = "shop-web"
size = 20
charge_mode = "traffic"
}
}resource "huaweicloud_lb_loadbalancer" "web" {
name = "shop-lb"
vip_subnet_id = huaweicloud_vpc_subnet.app.ipv4_subnet_id
}{
"id": "huaweicloud_vpc_eip.web",
"result": {
"class": "RECONFIGURE",
"confidence": "MEDIUM",
"target": {
"service": "STACKIT public IP"
},
"reason": "An EIP becomes a STACKIT public IP. The address itself changes, so DNS records and allow lists that name it change too."
}
}
{
"id": "huaweicloud_lb_loadbalancer.web",
"result": {
"class": "RECONFIGURE",
"confidence": "MEDIUM",
"target": {
"service": "STACKIT Network Load Balancer"
},
"reason": "A shared load balancer becomes a STACKIT Network Load Balancer. Listeners and backends are rewritten, and the public address changes."
}
}The address changes
An EIP becomes a STACKIT public IP, and the run states that the address itself changes. DNS records and allow lists that name the old one change with it.
Listeners are rewritten
A shared load balancer becomes a Network Load Balancer, its listeners and backends are rewritten and the public address changes. Plan the certificate and the health check with it.
The data tier: database and cache
Two stateful units, two different moves. The database keeps its engine; the cache changes product.
resource "huaweicloud_rds_instance" "db" {
name = "shop-db"
flavor = "rds.pg.n1.xlarge.2"
vpc_id = huaweicloud_vpc.shop.id
subnet_id = huaweicloud_vpc_subnet.data.id
security_group_id = huaweicloud_networking_secgroup.web.id
availability_zone = ["eu-west-101a"]
db {
type = "PostgreSQL"
version = "15"
}
volume {
type = "CLOUDSSD"
size = 200
}
}
resource "huaweicloud_dcs_instance" "sessions" {
name = "shop-sessions"
engine = "Redis"
engine_version = "6.0"
capacity = 4
flavor = "redis.ha.xu1.large.r2.4"
availability_zones = ["eu-west-101a", "eu-west-101b"]
password = var.redis_password
vpc_id = huaweicloud_vpc.shop.id
subnet_id = huaweicloud_vpc_subnet.data.id
}{
"id": "huaweicloud_rds_instance.db",
"result": {
"class": "REPLATFORM",
"confidence": "MEDIUM",
"target": {
"service": "STACKIT PostgreSQL Flex"
},
"reason": "Managed PostgreSQL to managed PostgreSQL: data moves with pg_dump/pg_restore or logical replication, and the flavor becomes a Flex flavor."
}
}
{
"id": "huaweicloud_dcs_instance.sessions",
"result": {
"class": "RECONFIGURE",
"confidence": "MEDIUM",
"target": {
"service": "STACKIT Key Value Store (Valkey)"
},
"reason": "A DCS instance becomes a Valkey instance. The application changes its endpoint and credentials; check the engine and version in use, since a Memcached instance needs a client change."
}
}PostgreSQL to PostgreSQL
The run names pg_dump with pg_restore or logical replication, and the flavor becomes a Flex flavor. The source runs version 15; STACKIT’s notes put version 14 at end of support on 12 November 2026, so 15 or higher is a safe starting point to confirm.
The cache needs its own method
Huawei lists MIGRATE as disabled for DCS Redis 6.0, so the copy method STACKIT documents for its Redis offering does not apply as written. The tutorial on DCS and Valkey on this site covers it.
Data is a decision, not a result
migration/data-movement.md lists three stateful units, the cache, the bucket and the database, each with mechanism UNKNOWN and DECISION_REQUIRED.
The one LOW unit: a security group
The group itself maps cleanly. Confidence drops because one linked resource is not assessed.
resource "huaweicloud_networking_secgroup" "web" {
name = "shop-web"
description = "Web tier"
}
resource "huaweicloud_networking_secgroup_rule" "https" {
security_group_id = huaweicloud_networking_secgroup.web.id
direction = "ingress"
ethertype = "IPv4"
protocol = "tcp"
ports = "443"
remote_ip_prefix = "0.0.0.0/0"
}{
"id": "huaweicloud_networking_secgroup.web",
"result": {
"class": "RECONFIGURE",
"confidence": "LOW",
"reason": "A security group becomes a STACKIT security group. STACKIT rules only allow traffic, so a deny rule or a priority order of the source needs a decision.",
"findings": [
{
"check_id": "uncatalogued-related",
"severity": "warning",
"message": "huaweicloud_networking_secgroup_rule.https (huaweicloud_networking_secgroup_rule) is linked to this unit; the knowledge base catalogues it but has no mapping rule, semantic contract or criticality row for it (catalogued but unmapped), so what it does to this unit is not assessed."
}
]
}
}Catalogued but unmapped
The run knows the rule type and has no mapping for it, so it says what the rule does to the group is not assessed. Read the rule yourself: the demo allows HTTPS from anywhere.
Deny rules need a decision
STACKIT rules only allow traffic. A deny rule or a priority order in a real source needs an explicit design choice.
Order and ownership
The waves from migration/technical-sequencing.md, and the ten work packages from execution/README.md.
## Wave 1 — 6 unit(s)
| Unit | Class | Target |
|---|---|---|
| `huaweicloud_dns_recordset.www` | RECONFIGURE / MEDIUM | STACKIT DNS |
| `huaweicloud_kms_key.shop` | RECONFIGURE / MEDIUM | STACKIT KMS |
| `huaweicloud_networking_secgroup.web` | RECONFIGURE / LOW | STACKIT security groups |
| `huaweicloud_obs_bucket.media` | RECONFIGURE / MEDIUM | STACKIT Object Storage |
| `huaweicloud_vpc.shop` | RECONFIGURE / MEDIUM | STACKIT network |
| `huaweicloud_vpc_eip.web` | RECONFIGURE / MEDIUM | STACKIT public IP |
## Wave 2 — 3 unit(s)
| Unit | Class | Target |
|---|---|---|
| `huaweicloud_csms_secret.db` | RECONFIGURE / MEDIUM | STACKIT Secrets Manager |
| `huaweicloud_vpc_subnet.app` | RECONFIGURE / MEDIUM | STACKIT network |
| `huaweicloud_vpc_subnet.data` | RECONFIGURE / MEDIUM | STACKIT network |
## Wave 3 — 5 unit(s)
| Unit | Class | Target |
|---|---|---|
| `huaweicloud_cce_cluster.jobs` | REPLATFORM / MEDIUM | STACKIT Kubernetes Engine (SKE) |
| `huaweicloud_compute_instance.web` | RECONFIGURE / MEDIUM | STACKIT Compute Engine |
| `huaweicloud_dcs_instance.sessions` | RECONFIGURE / MEDIUM | STACKIT Key Value Store (Valkey) |
| `huaweicloud_lb_loadbalancer.web` | RECONFIGURE / MEDIUM | STACKIT Network Load Balancer |
| `huaweicloud_rds_instance.db` | REPLATFORM / MEDIUM | STACKIT PostgreSQL Flex || Package | Owner | Phase | Steps | Resources | Decisions to answer | State |
|---|---|---|---|---|---|---|
| [`WP-01`](manual/actions.md) Set up by hand the resources the draft writes nothing for (foundation) | Network Architect | foundation | 3 | 3 | — | a person can start it now |
| [`WP-02`](manual/actions.md) Set up by hand the resources the draft writes nothing for (security) | Network Architect | security | 1 | 1 | — | a person can start it now |
| [`WP-03`](manual/actions.md) Set up by hand the resources the draft writes nothing for (security) | Owner assignment required | security | 2 | 2 | — | a person can start it now |
| [`WP-04`](manual/actions.md) Set up by hand the resources the draft writes nothing for (data services) | Data Architect | data services | 2 | 2 | — | a person can start it now |
| [`WP-05`](manual/actions.md) Set up by hand the resources the draft writes nothing for (data services) | Storage Architect | data services | 1 | 1 | — | a person can start it now |
| [`WP-06`](manual/actions.md) Set up by hand the resources the draft writes nothing for (platform services) | Network Architect | platform services | 1 | 1 | — | a person can start it now |
| [`WP-07`](manual/actions.md) Set up by hand the resources the draft writes nothing for (platform services) | Platform Architect | platform services | 1 | 1 | — | a person can start it now |
| [`WP-08`](manual/actions.md) Set up by hand the resources the draft writes nothing for (workloads) | Network Architect | workloads | 1 | 1 | — | a person can start it now |
| [`WP-09`](manual/actions.md) Set up by hand the resources the draft writes nothing for (workloads) | Platform Architect | workloads | 1 | 1 | — | a person can start it now |
| [`WP-10`](manual/actions.md) Carry out the cutover steps | Network Architect | cutover | 1 | 1 | — | a person can start it now |One package has no owner
WP-03 holds the key and the secret and reads Owner assignment required, because this build has no owner role for the security category. The run reports the execution package as incomplete until someone is named.
Dependencies explain the waves
The database secret waits for the key because it names it. Everything in wave 3 waits for the subnets, the longest chain in the estate.
The decisions your architects own
Region and network design
Answer target.region, choose address ranges for the two STACKIT networks and decide whether routing needs a Network Area.
Database version and method
Pick the PostgreSQL major version on STACKIT, then the move: dump and restore, or logical replication, from the downtime you accept.
Cache copy method
Decide how keys reach Valkey without MIGRATE, and map the credentials and the allowed ranges. Multiple database numbers need a plan of their own.
Key and secret handling
Re-encrypt rather than export, check the algorithm against STACKIT’s list, and write the secret yourself in dependency order. The KMS and CSMS tutorial on this site walks through it.
Kubernetes version
The CCE cluster runs v1.31. The CCE page on this site covers the SKE versions to land on.
Cutover
Lower the DNS TTL, supply the new addresses for the record, write a rollback for each manual step and agree the window.
What this run does not tell you
No STACKIT Terraform
The draft folder contains the provider, variables and a README for this source. The target resources are named in the assessment, not written.
No data volumes
Sizes, change rates and tolerated downtime are not in the Terraform. They read NOT_PROVIDED until you supply them.
No check on STACKIT
Nothing is planned or applied against a STACKIT project. The package says so itself.
No view of what the code does not show
Console-made resources, application configuration and data on server disks are outside the run.
Questions about this walkthrough
Is this a typical Huawei Cloud estate?
It is a deliberately ordinary shop: web, database, cache, storage, secrets, DNS and a job cluster. The figures belong to this estate only. Your own run will count differently.
Why is the draft empty if the run succeeded?
The run assessed all 14 units and published its package. For a Huawei Cloud source this build writes no STACKIT resource blocks, so the migration steps are manual and the Terraform folder holds only scaffolding.
Which units would you start with?
Those in wave 1 and 2, which every other unit depends on: the network, the key and the security group. The sequencing file is a starting point for your own schedule, not a plan with dates.
Can I reproduce this?
Yes, with your own Terraform: run the assessment on the folder, then open index.html and read assessment.json, migration/technical-sequencing.md and execution/manual/actions.md in that order.
Sources
Your next move: STACKIT.
Tell us about your estate. We show you what StackToIT delivers for it: target architecture, Terraform artifacts and a structured migration plan.