Huawei DMS to STACKIT: Kafka, RabbitMQ and RocketMQ

Three brokers as input

A small Huawei Cloud estate written for this page and assessed by StackToIT on 4 November 2026, with a VPC, a subnet and a security group around the brokers. Left: Kafka and RabbitMQ. Right: RocketMQ. The broker password is a variable without a value, on purpose.

resource "huaweicloud_dms_kafka_instance" "stream" {
  name               = "orders-stream"
  engine_version     = "2.7"
  flavor_id          = "c6.2u4g.cluster"
  storage_spec_code  = "dms.physical.storage.ultra.v2"
  storage_space      = 600
  broker_num         = 3
  vpc_id             = huaweicloud_vpc.main.id
  network_id         = huaweicloud_vpc_subnet.brokers.id
  security_group_id  = huaweicloud_networking_secgroup.brokers.id
  availability_zones = ["eu-west-101a", "eu-west-101b", "eu-west-101c"]
  ssl_enable         = true
  access_user        = "orders"
  password           = var.broker_password
}

resource "huaweicloud_dms_rabbitmq_instance" "jobs" {
  name               = "jobs-queue"
  engine_version     = "3.8.35"
  flavor_id          = "c6.2u4g.cluster"
  storage_spec_code  = "dms.physical.storage.ultra.v2"
  broker_num         = 3
  vpc_id             = huaweicloud_vpc.main.id
  network_id         = huaweicloud_vpc_subnet.brokers.id
  security_group_id  = huaweicloud_networking_secgroup.brokers.id
  availability_zones = ["eu-west-101a", "eu-west-101b", "eu-west-101c"]
  access_user        = "jobs"
  password           = var.broker_password
}

resource "huaweicloud_dms_rocketmq_instance" "billing" {
  name               = "billing-events"
  engine_version     = "4.8.0"
  storage_space      = 300
  vpc_id             = huaweicloud_vpc.main.id
  subnet_id          = huaweicloud_vpc_subnet.brokers.id
  security_group_id  = huaweicloud_networking_secgroup.brokers.id
  availability_zones = ["eu-west-101a"]
  flavor_id          = "c6.4u8g.cluster"
  storage_spec_code  = "dms.physical.storage.high.v2"
  broker_num         = 1
}

Kafka and RabbitMQ, assessed

Excerpts of assessment.json with the values exactly as the run wrote them.

{
  "id": "huaweicloud_dms_kafka_instance.stream",
  "result": {
    "class": "CONTAINERIZE",
    "confidence": "MEDIUM",
    "target": {
      "service": "a self-managed Kafka-compatible broker on SKE",
      "resources": [
        "stackit_ske_cluster"
      ]
    },
    "reason": "STACKIT has no managed Kafka service. The broker runs self-managed on SKE, or the messaging design changes to RabbitMQ."
  }
}

{
  "id": "huaweicloud_dms_rabbitmq_instance.jobs",
  "result": {
    "class": "REPLATFORM",
    "confidence": "MEDIUM",
    "target": {
      "service": "STACKIT RabbitMQ",
      "resources": [
        "stackit_rabbitmq_instance",
        "stackit_rabbitmq_credential"
      ]
    },
    "reason": "DMS for RabbitMQ becomes STACKIT RabbitMQ. Exchanges, queues and credentials are recreated, and messages in flight are drained before cut-over."
  }
}

• Kafka: CONTAINERIZE

  The target is a Kafka-compatible broker you run on an SKE cluster. The run lists 13 Kafka settings for your architects, among them engine_version, broker_num, flavor_id, ssl_enable and access_user.

• RabbitMQ: REPLATFORM

  Exchanges, queues and credentials are recreated, and messages in flight are drained before cut-over. The run lists 11 settings, including engine_version, broker_num and the user.

• Passwords are never read into the report

  The password argument is one of the settings listed by name; no value appears in the run’s files.

RocketMQ and the order of the move

The RocketMQ unit is REDESIGN with confidence LOW. Right: technical-sequencing.md of the same run. The network units come first; the three brokers share wave 3.

{
  "id": "huaweicloud_dms_rocketmq_instance.billing",
  "result": {
    "class": "REDESIGN",
    "confidence": "LOW",
    "target": {
      "service": "STACKIT RabbitMQ",
      "resources": [
        "stackit_rabbitmq_instance",
        "stackit_rabbitmq_credential"
      ]
    },
    "reason": "STACKIT has no RocketMQ service. Ordered and delayed message semantics have to be redesigned for RabbitMQ, or the broker runs self-managed on SKE."
  }
}

## Wave 1 — 2 unit(s)

| Unit | Class | Target |
|---|---|---|
| `huaweicloud_networking_secgroup.brokers` | RECONFIGURE / MEDIUM | STACKIT security groups |
| `huaweicloud_vpc.main` | RECONFIGURE / MEDIUM | STACKIT network |

## Wave 2 — 1 unit(s)

| Unit | Class | Target |
|---|---|---|
| `huaweicloud_vpc_subnet.brokers` | RECONFIGURE / MEDIUM | STACKIT network |

## Wave 3 — 3 unit(s)

| Unit | Class | Target |
|---|---|---|
| `huaweicloud_dms_kafka_instance.stream` | CONTAINERIZE / MEDIUM | a self-managed Kafka-compatible broker on SKE |
| `huaweicloud_dms_rabbitmq_instance.jobs` | REPLATFORM / MEDIUM | STACKIT RabbitMQ |
| `huaweicloud_dms_rocketmq_instance.billing` | REDESIGN / LOW | STACKIT RabbitMQ |

• Conditional feasibility

  The run marks the RocketMQ target as conditional: the draft does not carry the feature, and a person re-makes the references to the network in the redesign.

• Brokers are not data units

  The run’s data-movement file reports that the source holds no database, cache, search domain, warehouse, volume, file share or object store, and the state is not applicable. Messages in queues and topics are not listed there, so the drain or replication plan is yours.

• One owner for the three brokers

  The three brokers form one work package owned by the Platform Architect; the network units go to the Network Architect.

How the DMS estate maps

Classes as the run decided them for six resources in six units. Kafka, RabbitMQ and the network units have confidence MEDIUM, RocketMQ LOW.

The migration, in order

Steps 1 to 3 are preparation the run supports directly. Steps 4 to 7 are general practice for each engine, labelled as such, because the run plans no message movement.

1. 01

   Supply the variables and run again

   Without a value for broker_password the run marks the source as VARIABLE_UNRESOLVED (completeness PARTIAL) and states that what reads the variable is unknown until a value is supplied. Give the value in a variable file with --var-file; the run is then complete.

2. 02

   Decide the landing per broker

   RabbitMQ lands on the managed service. For Kafka choose between running it on SKE and changing to RabbitMQ. For RocketMQ choose the redesign first, because it decides whether RabbitMQ or SKE is the target.

3. 03

   Land the network first

   The VPC and security group sit in wave 1, the subnet in wave 2. Brokers in wave 3 need the network they attach to, and clients need a route to it.

4. 04

   RabbitMQ: build, then recreate definitions

   Create the instance on a plan that matches the HA you had, set the access list, create credentials, then recreate exchanges, queues and bindings. RabbitMQ can export and import definitions through its management API; this is general practice. STACKIT’s own how-to restores queue definitions from a backup of an existing STACKIT instance, so it does not start from DMS.

5. 05

   RabbitMQ: drain and switch

   Stop producers, let consumers empty the queues, then point producers and consumers at the new endpoint. The run’s reason says messages in flight are drained before cut-over.

6. 06

   Kafka: stand up, replicate, move consumers

   Create the SKE cluster, run the broker on it, replicate topics from DMS (for example with Kafka’s MirrorMaker 2), move consumers once lag is zero, then producers. Keep DMS running until the last consumer group has moved.

7. 07

   RocketMQ: run the new design in parallel

   Move topic by topic once ordering and delay behaviour are settled in the new design, and keep the old broker until the last producer has moved.

Settings that change between DMS and STACKIT

The run names the settings; this table reads the ones that bite against the pages in the source list.

Source side: the demo input and the settings the run names. Target side: the STACKIT RabbitMQ pages on plans, lifecycle, instance access and migration in the source list.

Supplying the missing variable

The first run had no value for broker_password. The second run added --var-file with a placeholder value. Left: the first run. Right: the second run.

  Source completeness: PARTIAL (source status VARIABLE_UNRESOLVED)

  Source completeness: COMPLETE (source status COMPLETE)

• Requests that block the draft

  The Decisions line of the first run reports 6 open requests, 2 of which block the draft. The second reports 5, 1 blocking: the missing variable no longer counts, and the region question remains.

• Why this matters

  A source with unresolved variables is assessed as partial. Fill them before you rely on the class and the settings of the units that read them.

Decisions the architects own

• Kafka: run it or leave it

  Self-managed on SKE means your team operates brokers, storage and upgrades. SKE itself handles Kubernetes and operating-system updates. If the workload is simple queues, RabbitMQ may be the smaller change of design.

• STACKIT Intake is not the Kafka answer

  STACKIT Intake accepts streaming data over the Apache Kafka protocol and writes it into Apache Iceberg tables in the Dremio catalog. Its overview does not describe topics or consumer groups that applications read from, so it fits streams that end in analytics, not a broker that services consume.

• RocketMQ semantics

  List every topic that depends on ordering or delay and decide what replaces it before any move.

• Message handling at cutover

  Drain, replicate or accept loss of in-flight messages, per queue and per topic.

Questions messaging teams ask

Sources

• STACKIT Docs: RabbitMQ service plans
• STACKIT Docs: RabbitMQ lifecycle
• STACKIT Docs: Create and manage RabbitMQ instances
• STACKIT Docs: Migrate RabbitMQ data to a new instance
• STACKIT Docs: Kubernetes Engine
• STACKIT Docs: Intake