Applications
Which application each unit belongs to, and each application's migration strategy. Membership is the customer's file only: a unit is confirmed when the selectors of exactly one application match it, a conflict when several applications claim it (it belongs to none of them), unassigned when no selector matches. A module name never makes an application.
By state: 5 applications: 0 ready · 1 blocked · 2 redesign · 2 not ready; 5 PROPOSED by StackToIT (nobody has confirmed them), 0 confirmed by the customer.
No applications file was given, so no unit is grouped into an application. Pass --applications FILE (stacktoit assess --help names the schema of the file) to state the applications and the selectors that assign units to them.
Proposed grouping: SUGGESTED. Suggested from the workloads of the source, not confirmed by the customer: these groups are a reading of names, tags and references in the Terraform. Nothing is an application until the applications file (--applications) or the review file states it, and where it does the stated applications win and the suggestion is shown as a diff against them.
PROPOSED APPLICATION GROUPS — not confirmed
One group per workload that is switched on: an ECS service, a Lambda function, a Kubernetes deployment, stateful set, daemon set, replication controller, pod, job or cron job, a load balancer with the instances and Auto Scaling groups it routes to, an instance or Auto Scaling group no load balancer fronts, or an EKS cluster when the estate holds no Kubernetes workload (such a group is a platform: its workloads are not visible in Terraform). A group holds its workload and the datastores, security groups, roles, log groups, secrets, keys and similar units that only that workload reaches: what the workload depends on (for an ECS service what its task definition names, for a Lambda function what its environment names, for a load balancer what it routes to), what those depend on in turn, the queues, streams, topics, buckets and EventBridge rules that feed a member (an event source mapping, a subscription, a rule target or the permission that names the rule, a bucket notification), the units a policy of a member names in a statement that is not a Deny, the units a DNS record that the workload names points at (a DNS record or a service-discovery registration that only points at a member is shown and adds no member), the datastore behind a security group whose ingress names a security group the workload itself uses, and the units that exist only for a member and depend on it (volumes, autoscaling targets, the secret of a database, the roles and node security group of a cluster, the Service, Ingress, autoscaler, network policy and disruption budget of a Kubernetes workload). An application tag the source states as a literal (Application, App, ApplicationName, AppName, ApplicationId, Workload, or Service where there is none of those) names the application: workloads that share the value are one group, a tagged unit no workload reaches joins the group of its value, and a unit tagged with another value than the group that reaches it is shared. A tag read from a variable is shown and never decides. A unit that more than one group reaches is shared and belongs to no group, unless exactly one of them carries the unit's tag value. The network, the ECS cluster and the gateways belong to no group, and a module name never makes one. A group is named by its application tag, else by the name of its workload, else by the family of its task definition, else by its address.
These groups are not applications: nobody has confirmed them, no unit is a member of an application because of them, and the application counts do not read them. To adopt a group, copy it (its id and selectors) into review/applications.yaml and set review: confirmed on it; an entry that stays review: proposed or is rejected claims no unit. The same groups, one row per group and per unit, are in migration/applications.csv.
| Group | Workload | Evidence | Members | Counted in the totals | By class | Depends on |
|---|---|---|---|---|---|---|
carts | ECS service: module.retail_app_ecs.module.carts_service.aws_ecs_service.this | medium confidence: reference in the Terraform, same module call The references of the source make the group; no application tag confirms it. | 4 | 4 | RECONFIGURE 3, REPLATFORM 1 | |
catalog | ECS service: module.retail_app_ecs.module.catalog_service.aws_ecs_service.this | medium confidence: reference in the Terraform, named in the runtime configuration, security group rule The references of the source make the group; no application tag confirms it. | 5 | 5 | RECONFIGURE 3, REPLATFORM 2 | |
checkout | ECS service: module.retail_app_ecs.module.checkout_service.aws_ecs_service.this | medium confidence: reference in the Terraform, named in the runtime configuration, security group rule The references of the source make the group; no application tag confirms it. | 6 | 6 | RECONFIGURE 5, REPLATFORM 1 | orders |
orders | ECS service: module.retail_app_ecs.module.orders_service.aws_ecs_service.this | medium confidence: reference in the Terraform, secret or parameter named in the runtime configuration, security group rule The references of the source make the group; no application tag confirms it. | 10 | 10 | RECONFIGURE 8, REPLATFORM 2 | |
ui | ECS service: module.retail_app_ecs.module.ui_service.aws_ecs_service.this | medium confidence: reference in the Terraform, load balancer route The references of the source make the group; no application tag confirms it. | 7 | 7 | RECONFIGURE 6, REPLATFORM 1 | carts, catalog, checkout, orders |
carts: 4 members (suggested)
Dependencies (PROPOSED group): not assessed in this build No application code in the source.
- Can it move now: 17 of 26 steps can run now (4 wait for decisions; 5 no answer frees (not executable as the plan stands, or refused)).
- What blocks it: 6 decisions hold its steps; the ones that free most: DEC-GEN-CONVERT-POD-SEGMENTATION frees 4 by itself.
- How much work: 18 manual steps, 0 data moves.
- To accept: 5 open security decisions (DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-ECS-SERVICE-THIS, DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-IAM-ROLE-0AE33885, DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-ECS-SERVICE-THIS, DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CARTS-SERVICE-AWS-SECURITY-6B55ABCF and 1 more).
catalog: 5 members (suggested)
Dependencies (PROPOSED group): not assessed in this build No application code in the source.
- Can it move now: 19 of 41 steps can run now (11 wait for decisions; 11 no answer frees (not executable as the plan stands, or refused)).
- What blocks it: 6 decisions hold its steps; the ones that free most: DEC-GEN-CONVERT-POD-SEGMENTATION frees 3 by itself, DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE frees 2 by itself.
- How much work: 31 manual steps, 1 data move.
- To accept: 7 open security decisions (DEC-IAM-MODULE-DEPENDENCIES-MODULE-CATALOG-OPENSEARCH-AWS-OPENS-0034548E, DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-ECS-SE-865F7883, DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CATALOG-SERVICE-AWS-IAM-RO-88D16913, DEC-NET-MODULE-DEPENDENCIES-MODULE-CATALOG-OPENSEARCH-AWS-OPENS-0034548E and 3 more).
checkout: 6 members (suggested)
Dependencies (PROPOSED group): not assessed in this build No application code in the source.
- Can it move now: 25 of 46 steps can run now (3 of them rest on a default nobody confirmed; 1 more after a manual step; 11 wait for decisions; 9 no answer frees (not executable as the plan stands, or refused)).
- What blocks it: 6 decisions hold its steps; the ones that free most: DEC-GEN-CONVERT-DATA-MOVEMENT frees 4 by itself, DEC-GEN-CONVERT-POD-SEGMENTATION frees 4 by itself.
- How much work: 36 manual steps, 1 data move.
- To accept: 6 open security decisions (DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-ECS-S-3DCDC7C6, DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-IAM-R-7A7D9673, DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-ECS-S-3DCDC7C6, DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-CHECKOUT-SERVICE-AWS-SECUR-2F7B1E2F and 2 more).
orders: 10 members (suggested)
Dependencies (PROPOSED group): not assessed in this build No application code in the source.
- Can it move now: 40 of 79 steps can run now (6 of them rest on a default nobody confirmed; 1 more after a manual step; 24 wait for decisions; 14 no answer frees (not executable as the plan stands, or refused)).
- What blocks it: 6 decisions hold its steps; the ones that free most: DEC-GEN-CONVERT-DATA-MOVEMENT frees 4 by itself, DEC-GEN-CONVERT-POD-SEGMENTATION frees 4 by itself, DEC-GEN-CONVERT-API-OPT-IN frees 2 by itself.
- How much work: 62 manual steps, 1 data move.
- To accept: 8 open security decisions (DEC-IAM-MODULE-DEPENDENCIES-MODULE-ORDERS-RDS-AWS-RDS-CLUSTER-THIS, DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-ECS-SERVICE-THIS, DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-ORDERS-SERVICE-AWS-IAM-ROL-05049202, DEC-NET-MODULE-DEPENDENCIES-MODULE-ORDERS-RDS-AWS-RDS-CLUSTER-THIS and 4 more).
4 more units are in migration/application-chain.csv; the units with the most still to do come first here.
ui: 7 members (suggested)
Dependencies (PROPOSED group): not assessed in this build No application code in the source.
- Can it move now: 28 of 43 steps can run now (7 wait for decisions; 8 no answer frees (not executable as the plan stands, or refused)).
- What blocks it: 6 decisions hold its steps; the ones that free most: DEC-GEN-CONVERT-POD-SEGMENTATION frees 4 by itself.
- How much work: 32 manual steps, 0 data moves.
- To accept: 6 open security decisions (DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-ECS-SERVICE-THIS, DEC-IAM-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-IAM-ROLE-TA-E93926D0, DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-ALB-AWS-LB-THIS, DEC-NET-MODULE-RETAIL-APP-ECS-MODULE-UI-SERVICE-AWS-ECS-SERVICE-THIS and 2 more).
1 more unit is in migration/application-chain.csv; the units with the most still to do come first here.
Units several groups reach
These units are members of no suggested group and are in no group's totals: more than one workload reaches each of them.
module.dependencies.module.catalog_rds.aws_rds_cluster.this(aws_rds_cluster):catalog,ordersmodule.dependencies.module.catalog_rds.aws_security_group.this(aws_security_group):catalog,ordersmodule.dependencies.module.dynamodb_carts.aws_dynamodb_table.this(aws_dynamodb_table):carts,checkoutmodule.retail_app_ecs.aws_cloudwatch_log_group.ecs_tasks(aws_cloudwatch_log_group):carts,catalog,checkout,orders,uimodule.retail_app_ecs.aws_kms_key.cmk(aws_kms_key):catalog,ordersmodule.retail_app_ecs.aws_secretsmanager_secret.catalog_db(aws_secretsmanager_secret):catalog,ordersmodule.retail_app_ecs.aws_secretsmanager_secret.catalog_opensearch(aws_secretsmanager_secret):catalog,ordersmodule.retail_app_ecs.module.catalog_service.aws_security_group.this(aws_security_group):catalog,orders
Application compatibility of the drafted workloads
The draft writes Kubernetes manifests for 5 container service(s). Each has an application compatibility contract beside its manifest: what the manifest needs before it can start the application (the environment values, the secrets, the services and data stores it must be rebound to, the identity and the data store work), as a blocking checklist, with a template of the environment keys and secrets (names only). StackToIT never deploys the application and runs nothing on the target. It manages whether the human work is done, and it learns that from the customer, in the application_checklists of the decisions file: a workload is NOT_READY while checklist items are open, BLOCKED while a data store whose protocol changes (or is not assessed) has no answered code migration decision, READY_FOR_VALIDATION when every checklist item but the smoke test is marked done (the product's own verdict, and not a validation), and CUSTOMER_ATTESTED when the customer attests in the same file that the validation passed (the customer's statement, never a StackToIT verdict). A mark that no longer fits the run (another source, a changed item) is stale and counts as open. A kubeconform check or a kubectl apply --dry-run of the manifest establishes YAML validity only, not behaviour: it accepts a REQUIRED_ token in a string field, an empty ConfigMap and a Secret that does not exist, and runs nothing; the checklist of the application compatibility contract and an application smoke test on the target are what show that the workload works.
Applications: 0 of 5 ready for validation · 3 BLOCKED, 2 NOT_READY — causes: engine downgrade OpenSearch 3.3 → 2; code migration DynamoDB → MongoDB Flex; TLS-only Key Value Store (Valkey) endpoint (client change for ElastiCache); data protocol not assessed Aurora → MariaDB; 2 data stores with no drafted target and no assessed protocol; workload identity undecided on 5 of 5. The states are the customer's own record in the decisions file; StackToIT deployed and validated no application
DEPLOYMENT_BLOCKED: module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this and the application catalog (the engine downgrade OpenSearch 3.3 → 2) until a test shows the application works against the version STACKIT offers or an architecture decision (a self-managed engine on SKE, or waiting for the version) is recorded in the decisions file
Code change: 1 unit needs a code change in the application (DynamoDB → MongoDB Flex), counted apart from the automation figures (can run now, automation-eligible, actually runnable): a unit whose application is rewritten is not a unit whose infrastructure alone changes; 3 more drafted data stores have a protocol that is not assessed, so a code change is not ruled out (OpenSearch → OpenSearch, Aurora → MariaDB, ElastiCache → Key Value Store (Valkey))
| Workload | Readiness | Why | Items done | Data stores | Stated by the customer | Contract |
|---|---|---|---|---|---|---|
carts (module.retail_app_ecs.module.carts_service.aws_ecs_service.this) | BLOCKED | DATASTORE_PROTOCOL_CHANGE, DATASTORE_PROTOCOL_NOT_ASSESSED, IDENTITY_OPEN, FUNCTIONAL_CHECK_NOT_RUN | 0 of 4 | module.dependencies.module.dynamodb_carts.aws_dynamodb_table.autoscaled: PROTOCOL_NOT_ASSESSED, code migration decision OPENmodule.dependencies.module.dynamodb_carts.aws_dynamodb_table.autoscaled_gsi_ignore: PROTOCOL_NOT_ASSESSED, code migration decision OPENmodule.dependencies.module.dynamodb_carts.aws_dynamodb_table.this to MongoDB Flex: DATASTORE_PROTOCOL_CHANGE, code migration decision OPEN | nothing: the decisions file has no entry for this workload | terraform/applications/carts.jsonterraform/applications/carts.templates.yaml |
catalog (module.retail_app_ecs.module.catalog_service.aws_ecs_service.this) | BLOCKED | DATASTORE_PROTOCOL_NOT_ASSESSED, ENGINE_VERSION_DOWNGRADE, IDENTITY_OPEN, FUNCTIONAL_CHECK_NOT_RUN | 0 of 3 | module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this to OpenSearch: PROTOCOL_NOT_ASSESSED, code migration decision OPENmodule.dependencies.module.catalog_rds.aws_rds_cluster.this to MariaDB: PROTOCOL_NOT_ASSESSED, code migration decision OPEN | nothing: the decisions file has no entry for this workload | terraform/applications/catalog.jsonterraform/applications/catalog.templates.yaml |
checkout (module.retail_app_ecs.module.checkout_service.aws_ecs_service.this) | BLOCKED | DATASTORE_PROTOCOL_NOT_ASSESSED, IDENTITY_OPEN, FUNCTIONAL_CHECK_NOT_RUN | 0 of 2 | module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default to Key Value Store (Valkey): PROTOCOL_NOT_ASSESSED, code migration decision OPEN | nothing: the decisions file has no entry for this workload | terraform/applications/checkout.jsonterraform/applications/checkout.templates.yaml |
orders (module.retail_app_ecs.module.orders_service.aws_ecs_service.this) | NOT_READY | ENV_VALUES_REQUIRED, IDENTITY_OPEN, FUNCTIONAL_CHECK_NOT_RUN | 0 of 4 | module.dependencies.aws_mq_broker.mq to RabbitMQ: SAME_PROTOCOLmodule.dependencies.module.orders_rds.aws_rds_cluster.this to PostgreSQL Flex: SAME_PROTOCOL | nothing: the decisions file has no entry for this workload | terraform/applications/orders.jsonterraform/applications/orders.templates.yaml |
ui (module.retail_app_ecs.module.ui_service.aws_ecs_service.this) | NOT_READY | IDENTITY_OPEN, FUNCTIONAL_CHECK_NOT_RUN | 0 of 1 | none found | nothing: the decisions file has no entry for this workload | terraform/applications/ui.jsonterraform/applications/ui.templates.yaml |
The checklist of carts (0 of 4 items done, plus the smoke test) before terraform/kubernetes/carts/manifests.yaml is applied
BLOCKED: A data store this workload reaches changes protocol or has no assessed protocol, and its code migration decision is not answered: StackToIT keeps the workload blocked until the customer answers it in the decisions file.
datastore_protocol_check:module.dependencies.module.dynamodb_carts.aws_dynamodb_table.autoscaledOPEN: the data store module.dependencies.module.dynamodb_carts.aws_dynamodb_table.autoscaled is not drafted: decide its target and check that the application's client library speaks its protocol fingerprintsha256:452434a4541a3db21db09ea0d8d38c5df5b0acc9fa8314701f457a9616481161datastore_protocol_check:module.dependencies.module.dynamodb_carts.aws_dynamodb_table.autoscaled_gsi_ignoreOPEN: the data store module.dependencies.module.dynamodb_carts.aws_dynamodb_table.autoscaled_gsi_ignore is not drafted: decide its target and check that the application's client library speaks its protocol fingerprintsha256:1a1c50dc7df3d51f58cabf9784cc227a7645ae0bf7353c7b6e1db8f0da6fffa8datastore_code_change:module.dependencies.module.dynamodb_carts.aws_dynamodb_table.thisOPEN: the application reads DynamoDB through its API and the target stackit_mongodbflex_instance.dynamodb_tables (MongoDB Flex) speaks another protocol: the data access code of the application is rewritten and a new image is built before the manifest is applied; a database engine swap is not an application migration fingerprintsha256:aaadfdab94b93db541da5a6041c8afdd8f4258c5f84b5616c6ef55364781ff1aidentity:module.retail_app_ecs.module.carts_service.aws_iam_role.task_roleOPEN: answer target.workload.identity for module.retail_app_ecs.module.carts_service.aws_ecs_service.this; until then the pods run with no identity and every call the application made with the task role module.retail_app_ecs.module.carts_service.aws_iam_role.task_role fails fingerprintsha256:274e8e9ca7cf47e323b7f1766a4ad8813e7cb2656d5dee693825f58a93bb095asmoke_test:cartsOPEN: run an application smoke test on the target: the pods start, answer their clients through the Kubernetes Service carts, reach every dependency above and read and write their data; StackToIT runs nothing on the target fingerprintsha256:fd73c018a38d3f67ec495c31257e928922819e44e30a49096000f9d2594a7116
Names the application resolves (internal DNS dependencies, 1): the source VPC resolver answers them, the draft’s networks resolve public names only and STACKIT documents no private DNS zone. Each is listed with who uses it, what stands for it on STACKIT and how to check it from inside the cluster; a name with no decided provider is NOT_CARRIED with the reason, never assumed to resolve. The consumers are those the scan finds in the environment values; a call made from the application’s own code is not visible. These names add no checklist item.
SERVICE_CONNECT_ALIAScarts: CLUSTER_SERVICE — carts.<namespace>.svc.cluster.local (the Kubernetes Service carts; carts from a pod of the same namespace). Source: a Service Connect alias in the Cloud Map private DNS namespace retailstore.local (module.retail_app_ecs.aws_service_discovery_private_dns_namespace.this): the clients of the namespace resolve it through the Service Connect proxy of their tasks. Used by: none found by the scan. Check: resolve, from a pod of a client of carts, carts and carts.<namespace>.svc.cluster.local: expect the ClusterIP of the Kubernetes Service carts (kubectl get service carts)
Code migration decision OPEN: The protocol compatibility of DynamoDB and the target of module.dependencies.module.dynamodb_carts.aws_dynamodb_table.autoscaled is not assessed: has the application's use of it been checked? Owner: Application owner (development team); while it is open the workload stays BLOCKED. Answer it in application_checklists[].code_migration of the decisions file with this fingerprint: sha256:3a3532180fa98f2d9ed6e4008f984102c7dbc1cc657c4380ef955bfe03b89749.
compatibility-verified(lifts the block): the calls the application makes were checked against the target store and found compatibledifferent-target-store(keeps the workload blocked): a target store that speaks the protocol of the source is wanted instead: the draft is regenerated with it, and the workload stays blocked until then
Code migration decision OPEN: The protocol compatibility of DynamoDB and the target of module.dependencies.module.dynamodb_carts.aws_dynamodb_table.autoscaled_gsi_ignore is not assessed: has the application's use of it been checked? Owner: Application owner (development team); while it is open the workload stays BLOCKED. Answer it in application_checklists[].code_migration of the decisions file with this fingerprint: sha256:0af54169ba070dcc1f111588ed567956c5990aa825440f2e882493d0de204bde.
compatibility-verified(lifts the block): the calls the application makes were checked against the target store and found compatibledifferent-target-store(keeps the workload blocked): a target store that speaks the protocol of the source is wanted instead: the draft is regenerated with it, and the workload stays blocked until then
Data store protocol change: the application reads DynamoDB through its API and the target stackit_mongodbflex_instance.dynamodb_tables (MongoDB Flex) speaks another protocol: the data access code of the application is rewritten and a new image is built before the manifest is applied; a database engine swap is not an application migration
Code migration decision OPEN: The target stackit_mongodbflex_instance.dynamodb_tables speaks another protocol than DynamoDB: what is done about the data access code of carts? Owner: Application owner (development team); while it is open the workload stays BLOCKED. Answer it in application_checklists[].code_migration of the decisions file with this fingerprint: sha256:cf8ebb01fe1a077308775e1c4b2ec89f667e1ac098a627ac7e625fdd5351c6b5.
rewrite-data-access-code(lifts the block): the data access code of the application is rewritten to speak the protocol of the target store (the item DATASTORE_CODE_CHANGE is then done when the new image is built)different-target-store(keeps the workload blocked): a target store that speaks the protocol of the source is wanted instead: the draft is regenerated with it, and the workload stays blocked until then
Identity of the application (the task role module.retail_app_ecs.module.carts_service.aws_iam_role.task_role; the template of its ServiceAccount is terraform/applications/carts.templates.yaml): answer target.workload.identity for module.retail_app_ecs.module.carts_service.aws_ecs_service.this; until then the pods run with no identity and every call the application made with the task role module.retail_app_ecs.module.carts_service.aws_iam_role.task_role fails
- answer the input target.workload.identity for module.retail_app_ecs.module.carts_service.aws_ecs_service.this in inputs.json: with federated_service_account the draft writes the stackit_service_account of module.retail_app_ecs.module.carts_service.aws_iam_role.task_role, its federated identity provider for the SKE cluster's service-account issuer and the Kubernetes ServiceAccount carts in the manifest
- until then, create a STACKIT service account named after the task role module.retail_app_ecs.module.carts_service.aws_iam_role.task_role and grant it the role assignments the policies of module.retail_app_ecs.module.carts_service.aws_iam_role.task_role give (identity.tf lists them as the architect's variable)
- federate it to the SKE cluster's service-account issuer for the subject system:serviceaccount:<namespace>:carts, and apply the ServiceAccount of applications/carts.templates.yaml (its annotation holds the service account's e-mail) in the namespace of the workload
- change the application from the AWS SDK credential chain to the STACKIT SDK, which picks up the projected token: every call the application made with module.retail_app_ecs.module.carts_service.aws_iam_role.task_role fails until it does
The checklist of catalog (0 of 3 items done, plus the smoke test) before terraform/kubernetes/catalog/manifests.yaml is applied
BLOCKED: A data store this workload reaches changes protocol or has no assessed protocol, and its code migration decision is not answered: StackToIT keeps the workload blocked until the customer answers it in the decisions file. StackToIT keeps the workload blocked: the database engine version 3.3 is not offered in the region; the application cannot be verified against a downgraded engine until the decision DEC-GEN-CONVERT-ENGINE-VERSION-DOWNGRADE is answered (the customer answers it in the decisions file).
datastore_protocol_check:module.dependencies.module.catalog_opensearch.aws_opensearch_domain.thisOPEN: the protocol compatibility of OpenSearch and stackit_opensearch_instance.dependencies_catalog_opensearch_this (OpenSearch) is not assessed (the source runs 3.3 and the region offers 2, and the REST API, the clients and the plugins differ across major versions): check the calls the application makes against the target before the manifest is applied fingerprintsha256:0680823c09a91d27130e8ccf127fa4b5dc478ac04f9508e6b0be37c8bc6070f7datastore_protocol_check:module.dependencies.module.catalog_rds.aws_rds_cluster.thisOPEN: the target stackit_mariadb_instance.dependencies_catalog_rds_this (MariaDB) speaks the MySQL wire protocol, so a setting that selects the MySQL driver stays; MariaDB 10.11 documents incompatibilities with MySQL 8.0 that the application can meet (the authentication plugin of its accounts, the JSON type and operators, the default collation and sql_mode: the findings of the data store), and which of them it uses is not assessed: run the schema and the queries of the application against a MariaDB instance before the manifest is applied fingerprintsha256:b55a2fd4266b13d853a322d08b2cf3f7972abb26e420dc51108b4ae8c1457459identity:module.retail_app_ecs.module.catalog_service.aws_iam_role.task_roleOPEN: answer target.workload.identity for module.retail_app_ecs.module.catalog_service.aws_ecs_service.this; until then the pods run with no identity and every call the application made with the task role module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role fails fingerprintsha256:7ad5d41f0abdbd255bd24a03b571836ab3550636a04da904568dbf13033258f2smoke_test:catalogOPEN: run an application smoke test on the target: the pods start, answer their clients through the Kubernetes Service catalog, reach every dependency above and read and write their data; StackToIT runs nothing on the target fingerprintsha256:c4708d64953c81add11e3f3c7a0f54ecf8233d45bae04d9ffb3631c08f84d106
Names the application resolves (internal DNS dependencies, 3): the source VPC resolver answers them, the draft’s networks resolve public names only and STACKIT documents no private DNS zone. Each is listed with who uses it, what stands for it on STACKIT and how to check it from inside the cluster; a name with no decided provider is NOT_CARRIED with the reason, never assumed to resolve. The consumers are those the scan finds in the environment values; a call made from the application’s own code is not visible. These names add no checklist item.
MANAGED_ENDPOINTthe endpoint host of module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this (OpenSearch): ENDPOINT_ATTRIBUTE — the host name the STACKIT instance stackit_opensearch_instance.dependencies_catalog_opensearch_this (OpenSearch) publishes, read from the instance and its credential after it is applied; the draft holds no value of it. Source: the endpoint host AWS assigns OpenSearch module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this when it is applied (not visible statically), answered by AWS DNS (inside a VPC the VPC resolver answers it with a private address). Used by: catalog: module.retail_app_ecs.module.catalog_service.aws_ecs_task_definition.this references module.dependencies.module.catalog_opensearch.aws_opensearch_domain.this. Check: resolve, from a pod of catalog, the host of stackit_opensearch_instance.dependencies_catalog_opensearch_this and connect to its port: the draft does not state whether the name resolves to an address the cluster's network reaches, so record the address and that the connection opensMANAGED_ENDPOINTthe endpoint host of module.dependencies.module.catalog_rds.aws_rds_cluster.this (Aurora): ENDPOINT_ATTRIBUTE — the host name the STACKIT instance stackit_mariadb_instance.dependencies_catalog_rds_this (MariaDB) publishes, read from the instance and its credential after it is applied; the draft holds no value of it. Source: the endpoint host AWS assigns Aurora module.dependencies.module.catalog_rds.aws_rds_cluster.this when it is applied (not visible statically), answered by AWS DNS (inside a VPC the VPC resolver answers it with a private address). Used by: catalog: module.retail_app_ecs.module.catalog_service.aws_ecs_task_definition.this reads the secret module.retail_app_ecs.aws_secretsmanager_secret_version.catalog_db, which is built from module.dependencies.module.catalog_rds.aws_rds_cluster.this. Check: resolve, from a pod of catalog, the host of stackit_mariadb_instance.dependencies_catalog_rds_this and connect to its port: the draft does not state whether the name resolves to an address the cluster's network reaches, so record the address and that the connection opensSERVICE_CONNECT_ALIAScatalog: CLUSTER_SERVICE — catalog.<namespace>.svc.cluster.local (the Kubernetes Service catalog; catalog from a pod of the same namespace). Source: a Service Connect alias in the Cloud Map private DNS namespace retailstore.local (module.retail_app_ecs.aws_service_discovery_private_dns_namespace.this): the clients of the namespace resolve it through the Service Connect proxy of their tasks. Used by: none found by the scan. Check: resolve, from a pod of a client of catalog, catalog and catalog.<namespace>.svc.cluster.local: expect the ClusterIP of the Kubernetes Service catalog (kubectl get service catalog)
Code migration decision OPEN: The protocol compatibility of OpenSearch and the target stackit_opensearch_instance.dependencies_catalog_opensearch_this is not assessed: has the application's use of it been checked? Owner: Application owner (development team); while it is open the workload stays BLOCKED. Answer it in application_checklists[].code_migration of the decisions file with this fingerprint: sha256:3e2dadac228fe08cb770a5dadc471d1502b31b102b5668389783fc3d37623053.
compatibility-verified(lifts the block): the calls the application makes were checked against the target store and found compatibledifferent-target-store(keeps the workload blocked): a target store that speaks the protocol of the source is wanted instead: the draft is regenerated with it, and the workload stays blocked until then
Code migration decision OPEN: The protocol compatibility of Aurora and the target stackit_mariadb_instance.dependencies_catalog_rds_this is not assessed: has the application's use of it been checked? Owner: Application owner (development team); while it is open the workload stays BLOCKED. Answer it in application_checklists[].code_migration of the decisions file with this fingerprint: sha256:bdb5c39ce78117874f2a8e30f53120b54cf0b076481f246f4dcddb0a2a62cb4e.
compatibility-verified(lifts the block): the calls the application makes were checked against the target store and found compatibledifferent-target-store(keeps the workload blocked): a target store that speaks the protocol of the source is wanted instead: the draft is regenerated with it, and the workload stays blocked until then
Identity of the application (the task role module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role; the template of its ServiceAccount is terraform/applications/catalog.templates.yaml): answer target.workload.identity for module.retail_app_ecs.module.catalog_service.aws_ecs_service.this; until then the pods run with no identity and every call the application made with the task role module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role fails
- answer the input target.workload.identity for module.retail_app_ecs.module.catalog_service.aws_ecs_service.this in inputs.json: with federated_service_account the draft writes the stackit_service_account of module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role, its federated identity provider for the SKE cluster's service-account issuer and the Kubernetes ServiceAccount catalog in the manifest
- until then, create a STACKIT service account named after the task role module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role and grant it the role assignments the policies of module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role give (identity.tf lists them as the architect's variable)
- federate it to the SKE cluster's service-account issuer for the subject system:serviceaccount:<namespace>:catalog, and apply the ServiceAccount of applications/catalog.templates.yaml (its annotation holds the service account's e-mail) in the namespace of the workload
- change the application from the AWS SDK credential chain to the STACKIT SDK, which picks up the projected token: every call the application made with module.retail_app_ecs.module.catalog_service.aws_iam_role.task_role fails until it does
The checklist of checkout (0 of 2 items done, plus the smoke test) before terraform/kubernetes/checkout/manifests.yaml is applied
BLOCKED: A data store this workload reaches changes protocol or has no assessed protocol, and its code migration decision is not answered: StackToIT keeps the workload blocked until the customer answers it in the decisions file.
datastore_protocol_check:module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.defaultOPEN: the target stackit_valkey_instance.dependencies_checkout_elasticache_redis_default (Key Value Store, Valkey) speaks the Redis protocol and accepts TLS connections only, so the clients change: the source runs without TLS (transit_encryption_enabled = false), so the scheme redis:// becomes rediss://, the client's TLS option is switched on and the CA certificate of the instance is trusted; check the commands the application sends against the target before the manifest is applied (its credential is no administrator: CONFIG, ACL and MODULE are denied) fingerprintsha256:a426acab1dbc5d4cf073c913f54e7e451c42424ff68fb1e77451a8f9e8907608identity:module.retail_app_ecs.module.checkout_service.aws_iam_role.task_roleOPEN: answer target.workload.identity for module.retail_app_ecs.module.checkout_service.aws_ecs_service.this; until then the pods run with no identity and every call the application made with the task role module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role fails fingerprintsha256:584bf44338daf24e3d6bb96626e6681acf2477a2e0c5a9dc94e70a1db07af471smoke_test:checkoutOPEN: run an application smoke test on the target: the pods start, answer their clients through the Kubernetes Service checkout, reach every dependency above and read and write their data; StackToIT runs nothing on the target fingerprintsha256:6ebcff17abc01e49263b3fcc3a614249619bae82e7733dee1cdd38675a6551cf
Names the application resolves (internal DNS dependencies, 2): the source VPC resolver answers them, the draft’s networks resolve public names only and STACKIT documents no private DNS zone. Each is listed with who uses it, what stands for it on STACKIT and how to check it from inside the cluster; a name with no decided provider is NOT_CARRIED with the reason, never assumed to resolve. The consumers are those the scan finds in the environment values; a call made from the application’s own code is not visible. These names add no checklist item.
MANAGED_ENDPOINTthe endpoint host of module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default (ElastiCache): ENDPOINT_ATTRIBUTE — the host name the STACKIT instance stackit_valkey_instance.dependencies_checkout_elasticache_redis_default (Key Value Store (Valkey)) publishes, read from the instance and its credential after it is applied; the draft holds no value of it. Source: the endpoint host AWS assigns ElastiCache module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default when it is applied (not visible statically), answered by AWS DNS (inside a VPC the VPC resolver answers it with a private address). Used by: checkout: module.retail_app_ecs.module.checkout_service.aws_ecs_task_definition.this references module.dependencies.module.checkout_elasticache_redis.aws_elasticache_replication_group.default. Check: resolve, from a pod of checkout, the host of stackit_valkey_instance.dependencies_checkout_elasticache_redis_default and connect to its port: the draft does not state whether the name resolves to an address the cluster's network reaches, so record the address and that the connection opensSERVICE_CONNECT_ALIAScheckout: CLUSTER_SERVICE — checkout.<namespace>.svc.cluster.local (the Kubernetes Service checkout; checkout from a pod of the same namespace). Source: a Service Connect alias in the Cloud Map private DNS namespace retailstore.local (module.retail_app_ecs.aws_service_discovery_private_dns_namespace.this): the clients of the namespace resolve it through the Service Connect proxy of their tasks. Used by: none found by the scan. Check: resolve, from a pod of a client of checkout, checkout and checkout.<namespace>.svc.cluster.local: expect the ClusterIP of the Kubernetes Service checkout (kubectl get service checkout)
Code migration decision OPEN: The protocol compatibility of ElastiCache and the target stackit_valkey_instance.dependencies_checkout_elasticache_redis_default is not assessed: has the application's use of it been checked? Owner: Application owner (development team); while it is open the workload stays BLOCKED. Answer it in application_checklists[].code_migration of the decisions file with this fingerprint: sha256:d2632928c6a75f74c14ad8d0b4552ace49e36051cc4e6b5690cc009e40f937b3.
compatibility-verified(lifts the block): the calls the application makes were checked against the target store and found compatibledifferent-target-store(keeps the workload blocked): a target store that speaks the protocol of the source is wanted instead: the draft is regenerated with it, and the workload stays blocked until then
Identity of the application (the task role module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role; the template of its ServiceAccount is terraform/applications/checkout.templates.yaml): answer target.workload.identity for module.retail_app_ecs.module.checkout_service.aws_ecs_service.this; until then the pods run with no identity and every call the application made with the task role module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role fails
- answer the input target.workload.identity for module.retail_app_ecs.module.checkout_service.aws_ecs_service.this in inputs.json: with federated_service_account the draft writes the stackit_service_account of module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role, its federated identity provider for the SKE cluster's service-account issuer and the Kubernetes ServiceAccount checkout in the manifest
- until then, create a STACKIT service account named after the task role module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role and grant it the role assignments the policies of module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role give (identity.tf lists them as the architect's variable)
- federate it to the SKE cluster's service-account issuer for the subject system:serviceaccount:<namespace>:checkout, and apply the ServiceAccount of applications/checkout.templates.yaml (its annotation holds the service account's e-mail) in the namespace of the workload
- change the application from the AWS SDK credential chain to the STACKIT SDK, which picks up the projected token: every call the application made with module.retail_app_ecs.module.checkout_service.aws_iam_role.task_role fails until it does
The checklist of orders (0 of 4 items done, plus the smoke test) before terraform/kubernetes/orders/manifests.yaml is applied
NOT_READY: Checklist items are open: StackToIT lists the work and counts an item done only when the customer marks it in the decisions file (application_checklists); StackToIT never deploys the application.
env_value:orders-service/RETAIL_ORDERS_MESSAGING_PROVIDEROPEN: set the key in the ConfigMap to the value module.retail_app_ecs.module.orders_service.aws_ecs_task_definition.this states for container orders-service (not copied: an environment value can carry a secret under any name); if it names an AWS endpoint, a region or an ARN, give the STACKIT one fingerprintsha256:d129bad0b42084609a1258577760beaef59dc3857057d30399ec88e78617ba12env_value:orders-service/RETAIL_ORDERS_PERSISTENCE_NAMEOPEN: set the key in the ConfigMap to the value module.retail_app_ecs.module.orders_service.aws_ecs_task_definition.this states for container orders-service (not copied: an environment value can carry a secret under any name); if it names an AWS endpoint, a region or an ARN, give the STACKIT one fingerprintsha256:42077f28d0241d4e33539948c6eba17b414a92cf587df59fd2f8f645f7f6308eenv_value:orders-service/RETAIL_ORDERS_PERSISTENCE_PROVIDEROPEN: set the key in the ConfigMap to the value module.retail_app_ecs.module.orders_service.aws_ecs_task_definition.this states for container orders-service (not copied: an environment value can carry a secret under any name); if it names an AWS endpoint, a region or an ARN, give the STACKIT one fingerprintsha256:acfe30323f398a862af97c3ecb12b86ea824fc2f5f475e3e482d33485bb565dcidentity:module.retail_app_ecs.module.orders_service.aws_iam_role.task_roleOPEN: answer target.workload.identity for module.retail_app_ecs.module.orders_service.aws_ecs_service.this; until then the pods run with no identity and every call the application made with the task role module.retail_app_ecs.module.orders_service.aws_iam_role.task_role fails fingerprintsha256:2f7a3f506b0709db4578c3d47bd9b4c8e48669c22d561fa3a720bd7a9035e2b8smoke_test:ordersOPEN: run an application smoke test on the target: the pods start, answer their clients through the Kubernetes Service orders, reach every dependency above and read and write their data; StackToIT runs nothing on the target fingerprintsha256:2d2c2134f7fcd58edfe984915a6bfcb8018d286f183ba0f961c57fe7ec355026
Names the application resolves (internal DNS dependencies, 3): the source VPC resolver answers them, the draft’s networks resolve public names only and STACKIT documents no private DNS zone. Each is listed with who uses it, what stands for it on STACKIT and how to check it from inside the cluster; a name with no decided provider is NOT_CARRIED with the reason, never assumed to resolve. The consumers are those the scan finds in the environment values; a call made from the application’s own code is not visible. These names add no checklist item.
MANAGED_ENDPOINTthe endpoint host of module.dependencies.aws_mq_broker.mq (Amazon MQ): ENDPOINT_ATTRIBUTE — the host name the STACKIT instance stackit_rabbitmq_instance.dependencies_mq (RabbitMQ) publishes, read from the instance and its credential after it is applied; the draft holds no value of it. Source: the endpoint host AWS assigns Amazon MQ module.dependencies.aws_mq_broker.mq when it is applied (not visible statically), answered by AWS DNS (inside a VPC the VPC resolver answers it with a private address). Used by: orders: module.retail_app_ecs.module.orders_service.aws_ecs_task_definition.this reads the secret module.retail_app_ecs.aws_secretsmanager_secret_version.mq, which is built from module.dependencies.aws_mq_broker.mq. Check: resolve, from a pod of orders, the host of stackit_rabbitmq_instance.dependencies_mq and connect to its port: the draft does not state whether the name resolves to an address the cluster's network reaches, so record the address and that the connection opensMANAGED_ENDPOINTthe endpoint host of module.dependencies.module.orders_rds.aws_rds_cluster.this (Aurora): ENDPOINT_ATTRIBUTE — the host name the STACKIT instance stackit_postgresflex_instance.dependencies_orders_rds_this (PostgreSQL Flex) publishes, read from the instance and its credential after it is applied; the draft holds no value of it. Source: the endpoint host AWS assigns Aurora module.dependencies.module.orders_rds.aws_rds_cluster.this when it is applied (not visible statically), answered by AWS DNS (inside a VPC the VPC resolver answers it with a private address). Used by: orders: module.retail_app_ecs.module.orders_service.aws_ecs_task_definition.this reads the secret module.retail_app_ecs.aws_secretsmanager_secret_version.orders_db, which is built from module.dependencies.module.orders_rds.aws_rds_cluster.this. Check: resolve, from a pod of orders, the host of stackit_postgresflex_instance.dependencies_orders_rds_this and connect to its port: the draft does not state whether the name resolves to an address the cluster's network reaches, so record the address and that the connection opensSERVICE_CONNECT_ALIASorders: CLUSTER_SERVICE — orders.<namespace>.svc.cluster.local (the Kubernetes Service orders; orders from a pod of the same namespace). Source: a Service Connect alias in the Cloud Map private DNS namespace retailstore.local (module.retail_app_ecs.aws_service_discovery_private_dns_namespace.this): the clients of the namespace resolve it through the Service Connect proxy of their tasks. Used by: none found by the scan. Check: resolve, from a pod of a client of orders, orders and orders.<namespace>.svc.cluster.local: expect the ClusterIP of the Kubernetes Service orders (kubectl get service orders)
Identity of the application (the task role module.retail_app_ecs.module.orders_service.aws_iam_role.task_role; the template of its ServiceAccount is terraform/applications/orders.templates.yaml): answer target.workload.identity for module.retail_app_ecs.module.orders_service.aws_ecs_service.this; until then the pods run with no identity and every call the application made with the task role module.retail_app_ecs.module.orders_service.aws_iam_role.task_role fails
- answer the input target.workload.identity for module.retail_app_ecs.module.orders_service.aws_ecs_service.this in inputs.json: with federated_service_account the draft writes the stackit_service_account of module.retail_app_ecs.module.orders_service.aws_iam_role.task_role, its federated identity provider for the SKE cluster's service-account issuer and the Kubernetes ServiceAccount orders in the manifest
- until then, create a STACKIT service account named after the task role module.retail_app_ecs.module.orders_service.aws_iam_role.task_role and grant it the role assignments the policies of module.retail_app_ecs.module.orders_service.aws_iam_role.task_role give (identity.tf lists them as the architect's variable)
- federate it to the SKE cluster's service-account issuer for the subject system:serviceaccount:<namespace>:orders, and apply the ServiceAccount of applications/orders.templates.yaml (its annotation holds the service account's e-mail) in the namespace of the workload
- change the application from the AWS SDK credential chain to the STACKIT SDK, which picks up the projected token: every call the application made with module.retail_app_ecs.module.orders_service.aws_iam_role.task_role fails until it does
The checklist of ui (0 of 1 items done, plus the smoke test) before terraform/kubernetes/ui/manifests.yaml is applied
NOT_READY: Checklist items are open: StackToIT lists the work and counts an item done only when the customer marks it in the decisions file (application_checklists); StackToIT never deploys the application.
identity:module.retail_app_ecs.module.ui_service.aws_iam_role.task_roleOPEN: answer target.workload.identity for module.retail_app_ecs.module.ui_service.aws_ecs_service.this; until then the pods run with no identity and every call the application made with the task role module.retail_app_ecs.module.ui_service.aws_iam_role.task_role fails fingerprintsha256:7184de62a9f703854bfef735201ac410813bcb4120d8fd08306cd98b3d186cb7smoke_test:uiOPEN: run an application smoke test on the target: the pods start, answer their clients through the Kubernetes Service ui, reach every dependency above and read and write their data; StackToIT runs nothing on the target fingerprintsha256:6807f114890547e5a95a35f7650329b48d182fa9c12e17f39b4c559c9ceeb727
Names the application resolves (internal DNS dependencies, 1): the source VPC resolver answers them, the draft’s networks resolve public names only and STACKIT documents no private DNS zone. Each is listed with who uses it, what stands for it on STACKIT and how to check it from inside the cluster; a name with no decided provider is NOT_CARRIED with the reason, never assumed to resolve. The consumers are those the scan finds in the environment values; a call made from the application’s own code is not visible. These names add no checklist item.
SERVICE_CONNECT_ALIASui: CLUSTER_SERVICE — ui.<namespace>.svc.cluster.local (the Kubernetes Service ui; ui from a pod of the same namespace). Source: a Service Connect alias in the Cloud Map private DNS namespace retailstore.local (module.retail_app_ecs.aws_service_discovery_private_dns_namespace.this): the clients of the namespace resolve it through the Service Connect proxy of their tasks. Used by: none found by the scan. Check: resolve, from a pod of a client of ui, ui and ui.<namespace>.svc.cluster.local: expect the ClusterIP of the Kubernetes Service ui (kubectl get service ui)
Identity of the application (the task role module.retail_app_ecs.module.ui_service.aws_iam_role.task_role; the template of its ServiceAccount is terraform/applications/ui.templates.yaml): answer target.workload.identity for module.retail_app_ecs.module.ui_service.aws_ecs_service.this; until then the pods run with no identity and every call the application made with the task role module.retail_app_ecs.module.ui_service.aws_iam_role.task_role fails
- answer the input target.workload.identity for module.retail_app_ecs.module.ui_service.aws_ecs_service.this in inputs.json: with federated_service_account the draft writes the stackit_service_account of module.retail_app_ecs.module.ui_service.aws_iam_role.task_role, its federated identity provider for the SKE cluster's service-account issuer and the Kubernetes ServiceAccount ui in the manifest
- until then, create a STACKIT service account named after the task role module.retail_app_ecs.module.ui_service.aws_iam_role.task_role and grant it the role assignments the policies of module.retail_app_ecs.module.ui_service.aws_iam_role.task_role give (identity.tf lists them as the architect's variable)
- federate it to the SKE cluster's service-account issuer for the subject system:serviceaccount:<namespace>:ui, and apply the ServiceAccount of applications/ui.templates.yaml (its annotation holds the service account's e-mail) in the namespace of the workload
- change the application from the AWS SDK credential chain to the STACKIT SDK, which picks up the projected token: every call the application made with module.retail_app_ecs.module.ui_service.aws_iam_role.task_role fails until it does