Oracle Cloud to STACKIT migration checklist

Two units no mapping covers

Start by finding the units the run could not decide. In the demo estate a private DNS zone and an IAM policy end as MANUAL_REVIEW. Left: the input. Right: the decision as it stands in assessment.json. assessment.json is written as a single line, so the pane shows selected fields of each unit, indented and nested as in the file, with the values unchanged.

resource "oci_dns_zone" "internal" {
  compartment_id = var.compartment_id
  name           = "batch.example.internal"
  zone_type      = "PRIMARY"
  scope          = "PRIVATE"
}

resource "oci_identity_policy" "batch" {
  compartment_id = var.compartment_id
  name           = "batch-policy"
  description    = "Allow the batch group to manage objects"
  statements     = ["Allow group batch-operators to manage objects in compartment batch"]
}

[
  {
    "id": "oci_dns_zone.internal",
    "result": {
      "class": "MANUAL_REVIEW",
      "confidence": "LOW",
      "reason": "oci_dns_zone is not in the knowledge base catalogue; an architect has to decide the target. Nothing of this resource is assessed or drafted (unknown source type)."
    }
  },
  {
    "id": "oci_identity_policy.batch",
    "result": {
      "class": "MANUAL_REVIEW",
      "confidence": "LOW",
      "reason": "OCI policies have no document-level counterpart on STACKIT. Map people and workloads to STACKIT roles and service accounts."
    }
  }
]

• Unknown type, no target

  oci_dns_zone is not in the catalogue of this build, so nothing about it is assessed or drafted. It becomes a manual step with no owner role named, which execution/manual/actions.md says in so many words.

• A policy is not a role

  OCI policies have no document-level counterpart on STACKIT. The run asks you to map people and workloads to STACKIT roles and service accounts.

Phase 1 · Discovery: know what the run saw

• Commit the dependency lock file

  .terraform.lock.hcl goes with the root module. Without an entry for oci the report warns that the provider version is not proven and caps the units at medium confidence. Check: engineering/architect-report.md, the note on source providers.

• Confirm the source is complete

  The summary must say source status COMPLETE and the Source status section must name no module that was not scanned. Check: assessment.json, summary, and architect-report.md.

• Compare the unit count with the tenancy

  The demo has 8 resources and 8 units. Anything created in the console and not in Terraform is invisible to the run; list it by hand. Check: the Summary table in the report.

• List every MANUAL_REVIEW unit

  Here: the DNS zone and the IAM policy. Each is a decision for a person. Check: the Architect review queue in the report.

Phase 2 · Design: decide what the run leaves open

• Answer the region request

  One request blocks the draft: target.region, eu01 or eu02. Check: review/inputs.yaml, then run again on the same output folder.

• Map policies to roles

  The batch group of the demo needs a STACKIT role and a service account for the workload. Check: the unit oci_identity_policy.batch in the report.

• Pick the target for the DNS zone

  No target is proposed. Decide whether the private zone becomes a STACKIT DNS zone or another design, and record it in the note of its step in review/progress.yaml.

• Choose a flavor for the instance

  The shape VM.Standard.E5.Flex with 4 OCPUs and 32 GB becomes a STACKIT flavor, and the image is rebuilt or imported. Check: the unit oci_core_instance.batch.

• Choose a performance class for the volume

  vpus_per_gb = 10 is an OCI setting that does not carry over. Check: the unit oci_core_volume.scratch.

Phase 3 · Build: create the target in the run's order

• Follow the waves

  Wave 1: VCN, volume, file system, bucket, DNS zone and policy. Wave 2: the subnet. Wave 3: the instance. Check: migration/technical-sequencing.md.

• Write the Terraform yourself

  The draft holds 0 units: terraform/ has only the provider and variable files. Plan your own STACKIT Terraform from the decisions above. Check: terraform/README.md.

• Import the image

  STACKIT accepts raw, qcow2 and iso images up to 70 GB; check that the uploaded image shows the state AVAILABLE before you create a server from it. Check: STACKIT docs on custom images.

• Rewrite file share access

  A file system becomes a STACKIT File Storage share; mount targets and export rules are rewritten. Check: the unit oci_file_storage_file_system.shared.

• Re-create bucket rules

  Clients change endpoint and credentials; lifecycle, replication and access rules are rewritten. Versioning is enabled in the input; STACKIT lists versioning among its Object Storage features, so switch it on for the new bucket and confirm it. Check: the unit oci_objectstorage_bucket.exports.

Phase 4 · Data: three stateful units, no method chosen

• Fill in what the run cannot know

  All three stateful units (volume, file system, bucket) show mechanism UNKNOWN and state DECISION_REQUIRED, with data class, recovery point and downtime tolerance NOT_PROVIDED. Check: migration/data-movement.md and data-movement.csv.

• Write the sizes down yourself

  The run lists the provisioned capacity as not stated in the source, although the volume sets 500 GB. Take sizes from the console, not from the run.

• Choose a method per unit

  Block volume at host or from backup, file copy for the share, an S3-compatible client for the bucket (for example rclone). StackToIT never moves data.

• Rehearse and verify

  Copy once, compare counts and checksums, and time it. A rehearsal that was never run is not a plan (general practice).

Phase 5 · Cutover: one switch after another

• Lower the DNS TTL ahead of the window

  Applies to every record that names an OCI address (general practice).

• Agree the write freeze

  For the bucket, the share and the volume, name who stops writing and when (general practice).

• Write the rollback before the window

  What flips back, in which order, and who decides. See the cutover and rollback checklist for the full list.

• Check every owner is named

  One step in this run has no owner role. Until someone owns it the plan is not complete. Check: execution/manual/actions.md, section Assign an owner.

Phase 6 · After: close it properly

• Run the assessment again

  After decisions are recorded, run again and compare. Check: the new index.html, and your step states in review/progress.yaml.

• Hold the OCI side for the agreed period

  Delete the OCI estate only after the hold period (general practice).

• Keep the review folder with the code

  review/inputs.yaml answers the run and review/progress.yaml is your journal of each step with state, owner and note. The run raised no decision records for this estate, so decisions.yaml stays empty.

Where each answer lives

Questions before you start

Sources

• STACKIT docs: Use custom images with the IaaS API
• STACKIT docs: Introduction to Object Storage