Huawei Cloud services mapped to STACKIT, from an assessed estate

The service map, as the run classified it

Every unit is MEDIUM confidence. The estate has 13 resources and 13 units: the VPC and the subnet share one row here but are two units. Targets and classes are those the run wrote to assessment.json.

One row in detail: RDS for PostgreSQL

Left: the database as declared in the demo input. Right: the run's result for it, an excerpt of assessment.json with the values exactly as written.

resource "huaweicloud_rds_instance" "orders" {
  name                = "shop-orders"
  flavor              = "rds.pg.n1.large.2"
  vpc_id              = huaweicloud_vpc.core.id
  subnet_id           = huaweicloud_vpc_subnet.apps.id
  security_group_id   = huaweicloud_networking_secgroup.apps.id
  availability_zone   = ["eu-west-101a"]

  db {
    type     = "PostgreSQL"
    version  = "15"
    password = var.db_password
  }

  volume {
    type = "CLOUDSSD"
    size = 100
  }
}

{
  "id": "huaweicloud_rds_instance.orders",
  "result": {
    "class": "REPLATFORM",
    "confidence": "MEDIUM",
    "target": {
      "service": "STACKIT PostgreSQL Flex"
    },
    "reason": "Managed PostgreSQL to managed PostgreSQL: data moves with pg_dump/pg_restore or logical replication, and the flavor becomes a Flex flavor."
  }
}

• Managed to managed

  The run reads a Huawei PostgreSQL service and proposes PostgreSQL Flex. Data moves with pg_dump and pg_restore or logical replication, and the flavor becomes a Flex flavor.

• The password is a gap, on purpose

  The demo passes the password through a variable without a default. The run reports the variable as a request that blocks the draft instead of inventing a value.

• Class is not effort

  REPLATFORM says the component moves to a different platform model. How long the data copy takes depends on size and tolerated downtime, which the source does not state.

Where the same name hides a different behaviour

Each point below is a reason text from the run, with the STACKIT side checked against the public STACKIT documentation.

• Disks: the type does not carry over

  An EVS disk type such as SSD has no STACKIT twin. You choose a STACKIT performance class and move the data at host level or with the server image.

• Security groups: allow only

  STACKIT rules only allow traffic and are evaluated together. A deny rule or a priority order in the Huawei group needs a decision. Ingress is denied by default, except traffic from instances in the same security group; egress is allowed.

• Keys: material does not move

  A KMS key becomes a STACKIT KMS key, but the key material of the source does not move, so data encrypted with it is re-encrypted.

• Cache: check the engine

  A DCS instance becomes a Valkey instance. The application changes endpoint and credentials, and a Memcached instance would need a client change.

• Queues: drain before cutover

  Exchanges, queues and credentials of DMS for RabbitMQ are recreated on STACKIT RabbitMQ, and messages in flight are drained before cutover.

• Functions: no function service

  STACKIT has no function service. Each function is packaged as a container for SKE or Cloud Foundry and its triggers are replaced. The two platforms differ in who runs the pipeline: SKE leaves image builds to you, Cloud Foundry packages source code.

What the run asks of you before it can draft

The estate produced 8 open requests, 4 of which block the draft.

• Target region

  Which STACKIT region the estate is built in. The run offers eu01 and eu02.

• Three password variables

  db_password, cache_password and mq_password have no value in the source. The run marks them as sensitive and does not take them in its answer file: you supply them through tfvars or TF_VAR when the draft is applied.

• Project and traffic preferences

  The target project, observability, public ingress and egress are recorded as preferences this build cannot apply. You set them in the target environment.

• Four stateful units

  The Valkey instance, the disk, the bucket and the database each need a data movement mechanism. The run lists all four as DECISION_REQUIRED: the mechanism depends on data size, tolerated downtime and the consistency the application needs, and the source states none of them.

The waves the run computed

Seven units have no dependency, the subnet follows the VPC, and the five workload and data services come last. Verbatim from the run's migration plan.

## Wave 1 — 7 unit(s)

| Unit | Class | Target |
|---|---|---|
| `huaweicloud_dns_recordset.www` | RECONFIGURE / MEDIUM | STACKIT DNS |
| `huaweicloud_evs_volume.uploads` | RECONFIGURE / MEDIUM | STACKIT Block Storage |
| `huaweicloud_fgs_function.thumbnail` | CONTAINERIZE / MEDIUM | SKE workload (or Cloud Foundry Docker app) |
| `huaweicloud_kms_key.data` | RECONFIGURE / MEDIUM | STACKIT KMS |
| `huaweicloud_networking_secgroup.apps` | RECONFIGURE / MEDIUM | STACKIT security groups |
| `huaweicloud_obs_bucket.media` | RECONFIGURE / MEDIUM | STACKIT Object Storage |
| `huaweicloud_vpc.core` | RECONFIGURE / MEDIUM | STACKIT network |

## Wave 2 — 1 unit(s)

| Unit | Class | Target |
|---|---|---|
| `huaweicloud_vpc_subnet.apps` | RECONFIGURE / MEDIUM | STACKIT network |

## Wave 3 — 5 unit(s)

| Unit | Class | Target |
|---|---|---|
| `huaweicloud_cce_cluster.platform` | REPLATFORM / MEDIUM | STACKIT Kubernetes Engine (SKE) |
| `huaweicloud_compute_instance.web` | RECONFIGURE / MEDIUM | STACKIT Compute Engine |
| `huaweicloud_dcs_instance.sessions` | RECONFIGURE / MEDIUM | STACKIT Key Value Store (Valkey) |
| `huaweicloud_dms_rabbitmq_instance.events` | REPLATFORM / MEDIUM | STACKIT RabbitMQ |
| `huaweicloud_rds_instance.orders` | REPLATFORM / MEDIUM | STACKIT PostgreSQL Flex |

• Eight work packages

  The run groups the manual work into eight packages by phase: foundation (VPC and subnet), two security packages (security group, KMS key), two data packages (cache and database, disk and bucket), platform services (CCE, RabbitMQ, function), the ECS workload and the DNS cutover. Seven of them name an owner role, from Network Architect to Platform Architect.

• One owner is missing

  The KMS key package has no owner: the run writes NOT_STATED. Assign one when you plan the packages.

Questions about the mapping

Sources

• STACKIT Docs: security groups, concepts
• STACKIT Docs: SKE compared with Cloud Foundry
• STACKIT Docs: virtual networks, concepts
• STACKIT Docs: DNS record types
• Huawei Cloud Help Center: FunctionGraph features