StackToIT Migration Intelligence Workspace

Each line is a number or a list that one of the pages below states in full, and links to it. There is no score here, and nothing on this page means that the estate is safe to migrate.

Biggest blockers

77 to review: 71 critical settings and 6 decisions to make (4 plan decisions, 2 plan statements) · 1 default to confirm · 1 confirm only (open critical settings, and open decision records of the register)

Critical findings come first; then the findings of warning severity and the critical settings a person decides, the one that concerns the most units first; then the settings the draft already carries, to confirm only, and last the accepted design changes. At most ten are listed.

1. Review the account name setting · critical setting, open on 3 units (REVIEW) · owner: Identity Architect · concerns google_service_account.automation, google_service_account.client, google_service_account.server · closes when: A person decides what this finding asks, and records the evidence or the decision. The finding says: The account ID is not visible statically; the STACKIT account is named after the source address. — a variable's default, not a fact.
2. Map the IAM roles of the service account to STACKIT roles · critical setting, open on 3 units (REVIEW) · owner: Identity Architect · concerns google_service_account.automation, google_service_account.client, google_service_account.server · closes when: A person confirms the value against the target, or the knowledge base gains a rule that decides this setting.
3. Decide the resource that the unit depends on · warning finding · 2 units: This unit names google_firebase_hosting_site.client (google_firebase_hosting_site), whose own decision the target does not carry (it is REDESIGN), and the semantic contract of google_cloudbuild_trigger does not read google_firebase_hosting_site, so what the reference becomes is not assessed. · owner: unassigned (a finding records no owner role) · concerns google_cloudbuild_trigger.init, google_cloudbuild_trigger.placeholder
4. Run unsupported volume · warning finding · 2 units: A container mounts a Cloud SQL connection, a Cloud Storage bucket (through Cloud Storage FUSE) or an NFS share. The draft writes no volume for these and holds the pods until a person decides: connect to the migrated database or object store over the network instead of the mount, or mount a share or a volume of the cluster yourself. · owner: unassigned (a finding records no owner role) · concerns google_cloud_run_v2_job.migrate, google_cloud_run_v2_service.server
5. Decide how each principal with a grant on a secret reaches it on STACKIT · warning finding · 2 units: The secret has grants for individual principals. Access on STACKIT Secrets Manager is coarser than a Secret Manager grant: a Secrets Manager user is read-only or read-write for the whole secrets engine of its instance, with no scope to one secret or path. Narrower access exists only as role bindings on the instance or on a secret group (a named list of secrets) in the alpha API of the service, and the pinned provider offers them as resources of its experimental IAM feature (stackit_secretsmanager_instance_role_binding_v1 and stackit_secretsmanager_secret_group_role_binding_v1), which its documentation says may change or be removed; the specification does not list the roles a secret group accepts. A grant of one Google principal on one secret therefore cannot be carried one to one: decide per principal whether it gets a user of the whole instance, a role binding on a secret group of the secrets it may read, or a separate Secrets Manager instance. · owner: unassigned (a finding records no owner role) · concerns google_secret_manager_secret.django_admin_password, google_secret_manager_secret.django_settings
6. Choose the container image or artifact · critical setting, open on 2 units (REVIEW) · owner: Platform Architect · concerns google_cloud_run_v2_job.migrate, google_cloud_run_v2_service.server · closes when: A person confirms the executable artifact or image for the STACKIT target: where it is built or pulled from and that the same build runs there.
7. Confirm the region the data stays in · critical setting, open on 2 units (REVIEW) · concerns google_cloud_run_v2_job.migrate, google_cloud_run_v2_service.server · closes when: A person confirms the STACKIT region of the SKE cluster the workload runs on holds the residency the source region gave, since no mapping between Google and STACKIT regions is evidenced.
8. Decide how the secrets are carried · critical setting, open on 2 units (REVIEW) · owner: Identity Architect · concerns google_secret_manager_secret.django_admin_password, google_secret_manager_secret.django_settings · closes when: A person recreates the secret in the Secrets Manager instance, since its data is not written into the draft, and decides for each IAM member whether it gets a user of the whole instance, a role binding on a secret group, or a separate instance.
9. Provide the values of the secrets · critical setting, open on 2 units (REVIEW) · owner: Security Architect · concerns google_secret_manager_secret.django_admin_password, google_secret_manager_secret.django_settings · closes when: A person decides where the value comes from, supplies the document and the step has run.
10. Create the Kubernetes Secrets for the Secret Manager references · critical setting, open on 2 units (REVIEW) · owner: Security Architect · concerns google_cloud_run_v2_job.migrate, google_cloud_run_v2_service.server · closes when: A person creates the Kubernetes Secrets the manifest lists, filled from STACKIT Secrets Manager (for example with an External Secrets Operator).

… and 30 more groups to review, 1 confirm-only item (see Decisions).

Source assurance warnings

These warnings are about how well the source was read, not about what blocks the migration, so they are not listed among the blockers above. They are not dismissed: each is still a finding group, and the finding stays on every unit it concerns.

• Verify the version of the source provider · warning finding · 16 units: no lock file records the version of registry.terraform.io/hashicorp/google, and the constraint ">= 6, < 8" excludes it (pinned 8.4.0) (stated once for the whole estate, with the units it covers and the rest of the words)

Decisions people must take

Decision register: 6 decisions to make (4 plan decisions, 2 plan statements) · 1 default to confirm · 16 units to review (72 critical settings: 71 to decide (22 of them are conditional), 1 confirm only). See Decisions.

How much was understood

11 units are counted in the totals. Beside them 5 are decided only when OpenTofu plans (5 present with the defaults of their variables (a variable can change that)) and 0 are switched off; those are not measured. Evidence traces, by kind of entry of the unit list: active units with a block in the draft: 6 of 10 traced (6 from the lines the draft records for them, not from a typed plan; 4 drafted without a trace); active units with no block in the draft: 0 of 1 traced (nothing to trace); units decided only when OpenTofu plans: 1 of 5 traced (1 from the lines the draft records for them, not from a typed plan). An entry without a trace is not an entry with nothing open; the unit list says for each why it has none. 12 of 62 critical settings are resolved; 50 are open: a critical setting counts as resolved only when it has been decided, not when it has merely been looked at.

What the target would look like

15 entries of the unit list state a STACKIT target and 1 do not. The services, with the entries of each (Target Fit):

• STACKIT service account: 4 entries
• a workflow in STACKIT Git Pipelines (GitHub Actions syntax, STACKIT-managed or custom runners) or the customer's CI/CD: 3 entries
• STACKIT Secrets Manager: 2 entries
• Kubernetes Job/CronJob on SKE: 1 entry
• SKE workload (or Cloud Foundry Docker app): 1 entry
• STACKIT Object Storage: 1 entry
• STACKIT Object Storage as origin of a STACKIT CDN distribution, with a custom domain: 1 entry
• STACKIT PostgreSQL Flex: 1 entry
• STACKIT RabbitMQ: 1 entry

Price coverage, counted in drafted STACKIT resources (not the source resources the cost model counts): of the 5 drafted resources a price rule covers, 3 are priced and 2 are not (stackit_rabbitmq_instance.messaging, stackit_secretsmanager_instance.migrated_secrets; each with its reason in financial/priced-resources.csv); the other 5 drafted resources have no price rule. A resource is priced only where a tested rule joins it to one SKU of the public STACKIT price list; the lines with their quantities, amounts and totals are in financial/cost-model.json and financial/priced-resources.csv; a total is full only when every line of its scope is priced.

What happens next

1. Review the 71 open critical settings: a person decides each (index.html, Decisions page; assurance/critical-semantics.json, critical_semantic_resolution.open). 22 of them belong to units that exist only if a plan-time input holds (critical_semantic_resolution.conditional_open). 1 more is carried by the draft already: confirm only. (see it here)
2. Review the 4 open plan decisions and 0 manual actions of the draft (index.html, Architecture, Deployment prerequisites). Confirm the 1 default the draft carries out (index.html, Decisions page): no step waits for the answer, a person confirms each or changes it. (see it here)
3. Review the draft in terraform/: nothing in it is approved, and an architect has to review it before any use. (see it here)
4. Open index.html in a browser for the unit-by-unit view (offline, nothing is loaded).

The numbers of this run. The console prints the same lines at the end of the run, and engineering/architect-report.md and workspace.json (run_summary) state the same numbers: they are read from one model.

Readiness is shown per dimension. There is no overall score, and no dimension here means that the estate is safe to migrate.

Three states answer three questions. Coverage says how much of what the dimension counts is covered (Covered: all of it); it never says that anything is decided, validated or ready to deploy. Migration decisions is read from the Blockers and Open decisions columns of the same row: a Covered dimension can have blockers. Target validation says what StackToIT’s own checks established about the generated target for that dimension; no STACKIT plan is run, so nothing here means the draft plans or applies.

Semantic Accounting counts the critical settings the assessment accounted for; Critical Resolution counts those that are decided: accounted is not resolved. Terraform Draft Accounting counts the units whose critical settings are accounted for in the draft; it does not say that the draft validates or plans against STACKIT.

The six dimensions of the first screen read the rows of this matrix: Analyzed reads Source Fidelity; Drafted reads Terraform Draft Accounting (the units whose critical settings are accounted for in the draft; Drafted counts the units that have a generated resource); Validated reads the Target validation column; Deployable reads the package state of Migration Execution; Application Ready reads Target Functional Fit and the Operational Readiness row (no application compatibility contract exists in this build); Equivalent reads Semantic Accounting and Critical Resolution (accounted for is not resolved, and resolved is not equivalent). Security, Sovereignty & Exitability and Cost Confidence have pages of their own and no user-first dimension.

18 source files, 37 resources scanned, 29 dependencies between units. Every unit is listed on the Architecture page.

No unit is in the mapping class BLOCKED. That names a class of the mapping, not an absence of blockers: what holds the plan back is counted apart, under Migration readiness and Blockers above.

BLOCKED is also the state of an application (its checklist) and the state of a step of the plan that cannot run; the three are counted apart and none is the sum of the others.

Open decisions: 6 decisions to make (4 plan decisions, 2 plan statements) · 1 default to confirm · 16 units to review (72 critical settings: 71 to decide (22 of them are conditional), 1 confirm only). Cost coverage: 22 cost lines (14 of the source, 8 of the target), 2 priced. The estate (33 source resources), priced part: modelled infrastructure subtotal (3 of 33 source resources), SOURCE: none (NONE; 0 priced, 14 not priced and never filled in). The estate (33 source resources), priced part: modelled infrastructure subtotal (3 of 33 source resources), TARGET: 164.67 EUR (PARTIAL; 2 priced, 6 not priced and never filled in). This is an initial infrastructure cost estimate under explicit assumptions (the assumptions), not a bill. See Decisions and Cost.

Partially executable migration package. Steps defined: 78 in the execution plan (10 OpenTofu, 2 STACKIT API, 64 manual, 2 refused). Progress by kind of step: steps to answer: 24 · changes executable now: 5 · waiting: 47 (10 wait for a value); 2 refused (of 78 steps). 10 of the 12 automated steps (OpenTofu or a script) are free of decisions and manual prerequisites (2 require a design decision) · 0 can run as written · 10 of those 10 wait for a value (project_id, containers_machine_type, containers_nodes_max, containers_nodes_min and 7 more); a person can start 29 of the 64 manual steps now (10 wait for a manual prerequisite, 3 wait for an automated step, 22 require a design decision); 2 steps of the plan are permanently unsupported (refused). See Migration Execution. The execution package starts at execution/README.md. The order of the work and what the STACKIT project has to provide first are in migration/roadmap.md and migration/landing-zone-requirements.md.