# OpenTofu steps

Generated by StackToIT from `execution-plan.json`. Nothing in this folder has been run: StackToIT reads and writes files and creates, changes and deletes nothing in any cloud. Every step is carried out by a person, by OpenTofu or by a script of this folder that a person runs. Paths are relative to the output folder.

The draft is in `terraform/`. OpenTofu applies the whole draft at once and orders its blocks by their references itself; the tables list the OpenTofu steps of the plan for review, grouped by who applies them, each group in the plan's order.

The owner of an area is the person who applies it: a step is applied by the owner role the plan names for the category of the source unit its block is written from ("Applied by"), and a file whose blocks belong to two roles is applied by each role for its own blocks (the Work Board lists the same split). A step whose unit has no category in the owner table is listed last, with no role: none is guessed.

Every OpenTofu step of the plan that is part of this apply is executable.

## Complete these steps before tofu apply

OpenTofu applies the whole draft in one run. It orders its own blocks by their references and does not enforce the manual steps, the STACKIT API calls or the phases of the plan: complete the steps below first, in this order.

The OpenTofu steps of this plan depend on no manual step and on no STACKIT API call, so there is nothing to complete first.

## Before you apply

- Credentials: the STACKIT provider reads them from the environment, for example `STACKIT_SERVICE_ACCOUNT_KEY_PATH`; `terraform/README.md` says what the draft needs.
- Variables a step needs a value for (a variable without a default, or one the plan does not take as given): `containers_machine_type`, `containers_nodes_max`, `containers_nodes_min`, `media_bucket_name`, `postgres_allowed_cidrs`, `postgres_storage_size`, `postgresflex_storage_class`, `project_id`, `rabbitmq_allowed_cidrs`, `rabbitmq_plan_name`, `rabbitmq_version`.
- Variables read with the default the draft declares (check each): `availability_zones`.

## Commands

From the output folder:

```sh
cd terraform
tofu init
tofu validate
tofu plan -out=stackit.tfplan
tofu apply stackit.tfplan
```

## Steps

The number is the step's place among the OpenTofu steps in the plan's order.

### Applied by Identity Architect

| # | Step | Phase | Resources | File | Executable | Blocked by | Variables | Risks |
|---|---|---|---|---|---|---|---|---|
| 1 | `TF/stackit_secretsmanager_instance.migrated_secrets` | Security | `stackit_secretsmanager_instance.migrated_secrets` | `terraform/security.tf` | yes | — | `project_id` | the migration of `google_secret_manager_secret.django_admin_password` is not complete with this step: 3 critical settings of it that the draft does not carry are open in 2 steps, a step standing for several of them (3 manual, 0 refused): `secret-value`, `secret-settings`, `tcr-secret-id`; the migration of `google_secret_manager_secret.django_settings` is not complete with this step: 3 critical settings of it that the draft does not carry are open in 2 steps, a step standing for several of them (3 manual, 0 refused): `secret-value`, `secret-settings`, `tcr-secret-id` |
| 2 | `TF/stackit_secretsmanager_user.migration` | Security | `stackit_secretsmanager_user.migration` | `terraform/security.tf` | yes | — | `project_id` | the migration of `google_secret_manager_secret.django_admin_password` is not complete with this step: 3 critical settings of it that the draft does not carry are open in 2 steps, a step standing for several of them (3 manual, 0 refused): `secret-value`, `secret-settings`, `tcr-secret-id`; the migration of `google_secret_manager_secret.django_settings` is not complete with this step: 3 critical settings of it that the draft does not carry are open in 2 steps, a step standing for several of them (3 manual, 0 refused): `secret-value`, `secret-settings`, `tcr-secret-id` |
| 3 | `TF/stackit_service_account.automation` | Security | `stackit_service_account.automation` | `terraform/identity.tf` | yes | — | `project_id` | the migration of `google_service_account.automation` is not complete with this step: 2 critical settings of it that the draft does not carry are open in 1 step, a step standing for several of them (2 manual, 0 refused): `role-bindings`, `account-name` |
| 4 | `TF/stackit_service_account.client` | Security | `stackit_service_account.client` | `terraform/identity.tf` | yes | — | `project_id` | the migration of `google_service_account.client` is not complete with this step: 2 critical settings of it that the draft does not carry are open in 1 step, a step standing for several of them (2 manual, 0 refused): `role-bindings`, `account-name` |
| 5 | `TF/stackit_service_account.init` | Security | `stackit_service_account.init` | `terraform/identity.tf` | yes | — | `project_id` | the migration of `google_service_account.init` is not complete with this step: 2 critical settings of it that the draft does not carry are open in 1 step, a step standing for several of them (2 manual, 0 refused): `role-bindings`, `account-name`; the source creates google_service_account.init only under a condition (applies only if its count (var.init ? 1 : 0) holds when OpenTofu plans — present with the defaults of var.init (1 instance); a variable file (-var-file), -var or TF_VAR_init can change that): this step creates its target as the variables of the draft decide, so check that they create it exactly when the source's condition holds |
| 6 | `TF/stackit_service_account.server` | Security | `stackit_service_account.server` | `terraform/identity.tf` | yes | — | `project_id` | the migration of `google_service_account.server` is not complete with this step: 2 critical settings of it that the draft does not carry are open in 1 step, a step standing for several of them (2 manual, 0 refused): `role-bindings`, `account-name` |

### Applied by Storage Architect

| # | Step | Phase | Resources | File | Executable | Blocked by | Variables | Risks |
|---|---|---|---|---|---|---|---|---|
| 7 | `TF/stackit_objectstorage_bucket.media` | Data services | `stackit_objectstorage_bucket.media` | `terraform/storage.tf` | yes | — | `media_bucket_name`, `project_id` | the migration of `google_storage_bucket.media` is not complete with this step: 6 critical settings of it that the draft does not carry are open in 5 steps, a step standing for several of them (5 manual, 1 refused): `geo-replication`, `iam-access`, `iam-grant`, `public-access`, `force-destroy`, `tc-storage-bucket-name` |

### Applied by Data Architect

| # | Step | Phase | Resources | File | Executable | Blocked by | Variables | Risks |
|---|---|---|---|---|---|---|---|---|
| 8 | `TF/stackit_postgresflex_instance.postgres` | Data services | `stackit_postgresflex_instance.postgres` | `terraform/data.tf` | yes | — | `postgres_allowed_cidrs`, `postgres_storage_size`, `postgresflex_storage_class`, `project_id` | the migration of `google_sql_database_instance.postgres` is not complete with this step: 4 critical settings of it that the draft does not carry are open in 3 steps, a step standing for several of them (4 manual, 0 refused): `database-users`, `user-and-database-settings`, `tc-name`, `tcf-sql-database--name` |

### Applied by Platform Architect

| # | Step | Phase | Resources | File | Executable | Blocked by | Variables | Risks |
|---|---|---|---|---|---|---|---|---|
| 9 | `TF/stackit_rabbitmq_instance.messaging` | Platform services | `stackit_rabbitmq_instance.messaging` | `terraform/messaging.tf` | yes | — | `project_id`, `rabbitmq_allowed_cidrs`, `rabbitmq_plan_name`, `rabbitmq_version` | the migration of `google_pubsub_topic.faux` is not complete with this step: 1 critical setting of it that the draft does not carry is a step of its own (1 manual, 0 refused): `tc-name` |
| 10 | `TF/stackit_ske_cluster.containers` | Platform services | `stackit_ske_cluster.containers` | `terraform/kubernetes.tf` | yes | — | `availability_zones`, `containers_machine_type`, `containers_nodes_max`, `containers_nodes_min`, `project_id` | the migration of `google_cloud_run_v2_job.migrate` is not complete with this step: 9 critical settings of it that the draft does not carry are open in 4 steps, a step standing for several of them (9 manual, 0 refused): `k4-cloud-run-volume-mount-cloud-run-v2-job`, `cloud-run-v2-job-network-exposure`, `terraform-destroy-guard`, `service-identity`, `secrets`, `tc-cloud-run-v2-job-name`, `tc-cloud-run-v2-job-template--template--volumes--name`, `deployment-artifact`, `entry-point`; the migration of `google_cloud_run_v2_service.server` is not complete with this step: 11 critical settings of it that the draft does not carry are open in 4 steps, a step standing for several of them (11 manual, 0 refused): `k4-cloud-run-volume-mount-cloud-run-v2-service`, `iam-invocation`, `iam-policy-grant`, `terraform-destroy-guard`, `service-identity`, `environment`, `secrets`, `cloud-sql-connection`, `tc-cloud-run-v2-service-name`, `tc-cloud-run-v2-service-template--volumes--name`, `deployment-artifact` |