OCI Load Balancer and Network Load Balancer to STACKIT

Step 1: the demo estate and the command

A demo estate written for this tutorial: a VCN with a public and a private subnet, one server, an HTTPS load balancer with certificate, backend set, backend and listener, and a network load balancer for a TLS-wrapped MQTT port. It was assessed on 4 November 2026 with the command on the right, run from inside the demo's input folder, offline and without source validation because no provider mirror was at hand. Left: the network the two load balancers sit in, as it stands in main.tf; the load balancer block itself follows in step 2.

resource "oci_core_vcn" "edge" {
  compartment_id = var.compartment_id
  cidr_blocks    = ["10.30.0.0/16"]
  display_name   = "edge"
}

resource "oci_core_subnet" "public" {
  compartment_id = var.compartment_id
  vcn_id         = oci_core_vcn.edge.id
  cidr_block     = "10.30.1.0/24"
  display_name   = "public"
}

resource "oci_core_subnet" "app" {
  compartment_id             = var.compartment_id
  vcn_id                     = oci_core_vcn.edge.id
  cidr_block                 = "10.30.2.0/24"
  display_name               = "app"
  prohibit_public_ip_on_vnic = true
}

# run from inside the demo's input folder; the output folder sits next to it
stacktoit assess . ../out --offline --no-validate

# then open, in this order
../out/index.html
../out/engineering/architect-report.md
../out/migration/technical-sequencing.md
../out/execution/manual/actions.md

• Nothing connects to Oracle Cloud

  StackToIT reads the Terraform. It opens no connection to your tenancy, so the run needs only the .tf files of the estate.

• Pin the provider first

  The run warns that the oci provider is not pinned by a lock file entry and caps the units at medium confidence until it is. Commit .terraform.lock.hcl with the root module before the real run.

Step 2: the load balancer itself is assessed

The flexible-shape load balancer is the one unit of the HTTPS side that has a catalogued target. Left: the input. Right: the decision, as it stands in assessment.json. assessment.json is written as a single line, so the pane shows selected fields of each unit, indented and nested as in the file, with the values unchanged.

resource "oci_load_balancer_load_balancer" "web" {
  compartment_id = var.compartment_id
  display_name   = "web"
  shape          = "flexible"
  subnet_ids     = [oci_core_subnet.public.id]

  shape_details {
    minimum_bandwidth_in_mbps = 10
    maximum_bandwidth_in_mbps = 100
  }
}

{
  "id": "oci_load_balancer_load_balancer.web",
  "result": {
    "class": "RECONFIGURE",
    "confidence": "LOW",
    "target": {
      "service": "STACKIT Application Load Balancer"
    },
    "reason": "A load balancer becomes a STACKIT Application Load Balancer. Listeners, backends and certificates are rewritten, and the public address changes."
  }
}

• Class and target

  RECONFIGURE, with the STACKIT Application Load Balancer as the target. The reason names what changes: listeners, backends and certificates are rewritten, and the public address changes.

• Why the confidence is low

  The architect report names four linked resources that are not catalogued (backend, backend set, certificate and listener) and states that their effect on the migration is not assessed. The same block is MEDIUM in the case-study estate, which has no listeners or backend sets; in this run the network load balancer, with two such linked resources, also stays MEDIUM. Read LOW as: the HTTPS side has the most open parts.

• The bandwidth range

  The input sets 10 to 100 Mbps as a flexible shape. The report lists the shape settings among the settings left to you; the STACKIT ALB concepts page describes no bandwidth range, so confirm sizing with STACKIT instead of carrying the numbers over.

Step 3: certificate, backend set and listener are left to you

The resources that make an OCI load balancer useful are not in the catalogue of this build: certificate, backend set, backend and listener (lines 92 to 130 of main.tf). Each is a MANUAL_REVIEW unit with no target; the excerpt on the right shows three of them. The NLB backend set and listener behave the same way. assessment.json is written as a single line, so the pane shows selected fields of each unit, indented and nested as in the file, with the values unchanged.

resource "oci_load_balancer_certificate" "web" {
  load_balancer_id   = oci_load_balancer_load_balancer.web.id
  certificate_name   = "web-cert"
  public_certificate = var.tls_certificate
  private_key        = var.tls_private_key
}

resource "oci_load_balancer_backend_set" "web" {
  load_balancer_id = oci_load_balancer_load_balancer.web.id
  name             = "web-backends"
  policy           = "LEAST_CONNECTIONS"

  health_checker {
    protocol    = "HTTP"
    port        = 8080
    url_path    = "/healthz"
    return_code = 200
  }
}

resource "oci_load_balancer_backend" "web1" {
  load_balancer_id = oci_load_balancer_load_balancer.web.id
  backendset_name  = oci_load_balancer_backend_set.web.name
  ip_address       = "10.30.2.11"
  port             = 8080
}

resource "oci_load_balancer_listener" "https" {
  load_balancer_id         = oci_load_balancer_load_balancer.web.id
  name                     = "https"
  default_backend_set_name = oci_load_balancer_backend_set.web.name
  port                     = 443
  protocol                 = "HTTP"

  ssl_configuration {
    certificate_name        = oci_load_balancer_certificate.web.certificate_name
    verify_peer_certificate = false
  }
}

[
  {
    "id": "oci_load_balancer_certificate.web",
    "result": {
      "class": "MANUAL_REVIEW",
      "confidence": "LOW",
      "reason": "oci_load_balancer_certificate is not in the knowledge base catalogue; an architect has to decide the target. Nothing of this resource is assessed or drafted (unknown source type)."
    }
  },
  {
    "id": "oci_load_balancer_backend_set.web",
    "result": {
      "class": "MANUAL_REVIEW",
      "confidence": "LOW",
      "reason": "oci_load_balancer_backend_set is not in the knowledge base catalogue; an architect has to decide the target. Nothing of this resource is assessed or drafted (unknown source type)."
    }
  },
  {
    "id": "oci_load_balancer_listener.https",
    "result": {
      "class": "MANUAL_REVIEW",
      "confidence": "LOW",
      "reason": "oci_load_balancer_listener is not in the knowledge base catalogue; an architect has to decide the target. Nothing of this resource is assessed or drafted (unknown source type)."
    }
  }
]

• Six units, no target

  Of the 12 units, 6 are MANUAL_REVIEW: the certificate, the backend set, the backend and the listener of the HTTPS load balancer, and the backend set and listener of the network load balancer. Each becomes a manual step in execution/manual/actions.md.

• What the STACKIT model asks for

  On the ALB, a listener speaks HTTP or HTTPS, an HTTPS listener references a certificate stored through the STACKIT Certificate API by its ID, and targets sit in target pools by IP address with the port set on the pool. You write these by hand from the OCI settings above.

• TLS offloading or bridging

  The OCI listener terminates TLS. The ALB can do the same and forward plain HTTP, or bridge: it re-encrypts to the targets, with your own CA if you set one. Decide this per application; the run cannot.

Step 4: the network load balancer

The MQTT port is a layer 4 workload. The load balancer unit is mapped; its backend set and listener are again manual. assessment.json is written as a single line, so the pane shows selected fields of each unit, indented and nested as in the file, with the values unchanged.

resource "oci_network_load_balancer_network_load_balancer" "mqtt" {
  compartment_id = var.compartment_id
  display_name   = "mqtt"
  subnet_id      = oci_core_subnet.public.id
  is_private     = false
}

resource "oci_network_load_balancer_backend_set" "mqtt" {
  name                     = "mqtt-backends"
  network_load_balancer_id = oci_network_load_balancer_network_load_balancer.mqtt.id
  policy                   = "FIVE_TUPLE"
  is_preserve_source       = true

  health_checker {
    protocol = "TCP"
    port     = 8883
  }
}

resource "oci_network_load_balancer_listener" "mqtt" {
  name                     = "mqtt-tls"
  network_load_balancer_id = oci_network_load_balancer_network_load_balancer.mqtt.id
  default_backend_set_name = oci_network_load_balancer_backend_set.mqtt.name
  port                     = 8883
  protocol                 = "TCP"
}

[
  {
    "id": "oci_network_load_balancer_network_load_balancer.mqtt",
    "result": {
      "class": "RECONFIGURE",
      "confidence": "MEDIUM",
      "target": {
        "service": "STACKIT Network Load Balancer"
      },
      "reason": "A network load balancer becomes a STACKIT Network Load Balancer. Listeners and backends are rewritten, and the public address changes."
    }
  },
  {
    "id": "oci_network_load_balancer_listener.mqtt",
    "result": {
      "class": "MANUAL_REVIEW",
      "confidence": "LOW",
      "reason": "oci_network_load_balancer_listener is not in the knowledge base catalogue; an architect has to decide the target. Nothing of this resource is assessed or drafted (unknown source type)."
    }
  }
]

• Pass-through stays pass-through

  The OCI network load balancer is a pass-through service that preserves the client source address. The STACKIT NLB lists TCP and UDP balancing, TCP proxy and TLS passthrough, and its feature page does not list source address preservation as a feature of its own. Test what your broker sees as the client address before cutover.

• Public or private

  The input is public (is_private = false). The NLB feature page lists private-network deployment and an ephemeral IP; agree with STACKIT how the public address is attached before you plan the DNS change.

What each OCI setting becomes

The settings the demo estate sets, read against the STACKIT documentation named in the sources. Rows marked check are not settled by the run.

Rows are read from the opened STACKIT pages and the run output; where a page is silent the row says check.

The order of the move

The run orders the 12 units into five waves from their dependencies. Units in a wave can move in parallel; the load balancer parts come last because they depend on the load balancers, which depend on the networks.

1. 01

   Wave 1

   The VCN. Becomes the network layout and, where routing between networks is needed, a Network Area.

2. 02

   Wave 2

   The public and the private subnet, each a STACKIT network with its own address range.

3. 03

   Wave 3

   The server, the application load balancer and the network load balancer.

4. 04

   Wave 4

   The two backend sets and the certificate, all manual.

5. 05

   Wave 5

   The backend and the two listeners, all manual. The listener comes last because it depends on the backend set and the certificate.

What to change before you apply anything

• Plan a new public address

  Both reasons in the run say the public address changes. Lower the DNS TTL ahead of the cutover and list every record, allow list and partner firewall that names the old address.

• Answer the region request

  The run opens one request that blocks the draft: the target region, eu01 or eu02. Answer it in review/inputs.yaml and run again.

• Rewrite the rules, not just the objects

  Backend sets, listeners and certificates are re-created from the OCI settings in the table above. Keep that table with the change record.

• Test with a copy of real traffic

  Health check paths, header handling (the ALB sets X-Forwarded-For and X-Forwarded-Proto itself) and long connections are application behaviour. Rehearse them on a test load balancer before the window.

• Keep the OCI load balancers until the rollback window ends

  Switching DNS back to the old address is the cheapest rollback. Delete the OCI side only after the agreed hold period (general practice, not a run output).

Questions network teams ask

Sources

• STACKIT docs: Basic concepts of the Application Load Balancer
• STACKIT docs: Network Load Balancer features
• Oracle docs: Load Balancer overview
• Oracle docs: Network Load Balancer overview