# Trace of `terraform/kubernetes.tf` — 1 blocks

> FOR REVIEW — generated by StackToIT Assess. Architect review required before any decision.

Run `6f8f72b2-1c34-4cfc-8483-344c41245364` · source digest `sha256:19bfed642d5789ccada81b91d5c36e33175dcafd66dc46b1644ffa105d020000`

The draft keeps a one-paragraph comment above each block: where it comes from, why its values are what they are, what is not carried and which decision is open. Each section of this file is the whole comment the generators wrote for one block, unabridged and in the order they wrote it: the rule and the knowledge-base stamp, the references with their digests, the evidence of each chosen value, the reason of each attribute that is not written and the caveats of the checks. The `# trace:` line above a block names its section by the anchor, which is the trace id.

<a id="TR-d30d8f964263"></a>

## Trace TR-d30d8f964263 — stackit_ske_cluster.containers

| | |
|---|---|
| Block | `stackit_ske_cluster.containers` in `terraform/kubernetes.tf` |
| Source units | `google_cloud_run_v2_job.migrate`, `google_cloud_run_v2_service.server` |
| Comment | 11 lines as the generators wrote it, 12 lines kept above the block in the .tf (the last is the `# trace:` line) |

````text
One SKE cluster runs the migrated container workloads (Cloud Run jobs and Cloud Run services) as Deployments, Jobs and CronJobs; the manifests of Cloud Run resources (kubernetes/<workload>/manifests.yaml) and of Cloud Scheduler jobs (kubernetes/<job>/cronjob.yaml) are drafted where their template can be read, those of the other kinds are not generated. If the draft already has an SKE cluster, the architect may run them there and drop this one.
google_cloud_run_v2_job.migrate: WARNING run-unsupported-volume: A container mounts a Cloud SQL connection, a Cloud Storage bucket (through Cloud Storage FUSE) or an NFS share.
google_cloud_run_v2_job.migrate: WARNING source-provider-unverified: no lock file records the version of registry.terraform.io/hashicorp/google, and the constraint ">= 6, < 8" excludes it (pinned 8.4.0) (stated once for the whole estate)
DEFAULT: the zones of the node pool are var.availability_zones, ["eu01-1", "eu01-2", "eu01-3"] unless you set it (3 zones, every zone of the region the catalogue lists): the Google Cloud resources on this cluster state no zone to carry, so the draft spreads the pool over all of them. An SKE node pool's maximum must be at least the number of its zones (var.containers_nodes_max is checked against it): list fewer zones if the workloads need fewer nodes.
from google_cloud_run_v2_job.migrate: its Kubernetes manifests are kubernetes/migrate/manifests.yaml (the required inputs, secrets to create and NOT CARRIED lines are in its header).
google_cloud_run_v2_service.server: WARNING run-unsupported-volume: A container mounts a Cloud SQL connection, a Cloud Storage bucket (through Cloud Storage FUSE) or an NFS share.
google_cloud_run_v2_service.server: WARNING run-iam-policy: A full IAM policy (member/role bindings) is set directly on the service via policy_data; STACKIT has no per-service IAM policy resource, so who may invoke the migrated SKE workload is decided by a person — the draft carries no invocation check.
google_cloud_run_v2_service.server: WARNING source-provider-unverified: no lock file records the version of registry.terraform.io/hashicorp/google, and the constraint ">= 6, < 8" excludes it (pinned 8.4.0) (stated once for the whole estate)
from google_cloud_run_v2_service.server: its Kubernetes manifests are kubernetes/server/manifests.yaml (the required inputs, secrets to create and NOT CARRIED lines are in its header).
Lifecycle of google_cloud_run_v2_service.server not written to this block: ignore_changes = [scaling] names source attributes the draft does not hold under the same meaning (or by a part of them): state ignore_changes on the attribute that holds the value if the target is to leave it alone too.
replaces: google_cloud_run_v2_job.migrate, google_cloud_run_v2_service.server
````