# Migration plan draft — gcp-candidates/terraform-dynamic-python-webapp/infra

> FOR REVIEW — generated by StackToIT Assess. Architect review required before any decision.

Run `6f8f72b2-1c34-4cfc-8483-344c41245364` · source digest `sha256:19bfed642d5789ccada81b91d5c36e33175dcafd66dc46b1644ffa105d020000`

Waves are computed from resource dependencies: a unit moves only after every unit it depends on. Units in the same wave can move in parallel. This is a starting point for the architect's wave plan, not a schedule.

## Prerequisites — resolve before planning

These units are not wave members: their source is not resolved, so what exists in the source (or how many of it) is not established. Resolve each one, scan again, and only then plan around it. The wave numbers below are the dependency order of the units that are wave members (a prerequisite holds no wave, so it orders nothing); a unit that depends on a prerequisite is listed in its wave, and its dependency is open until the prerequisite is resolved — its `open_dependencies` in assessment.json name it. Resolving a prerequisite can move the units that depend on it to a later wave.

| Cause | Why it is open | Remedy | Units |
|---:|---|---|---:|
| 1 | count/for_each not known statically — whether and how many instances exist is open | supply the variable value (`--var-file`); its default is not taken | 5 |

| Unit | Cause | Class | Units that depend on it |
|---|---:|---|---:|
| `google_cloudbuild_trigger.activategcb` | 1 | REDESIGN / MEDIUM | 0 |
| `google_cloudbuild_trigger.init` | 1 | REDESIGN / LOW | 0 |
| `google_cloudbuild_trigger.placeholder` | 1 | REDESIGN / LOW | 0 |
| `google_firebase_hosting_site.client` | 1 | REDESIGN / LOW | 2 |
| `google_service_account.init` | 1 | RECONFIGURE / MEDIUM | 3 |

## Wave 1 — 6 unit(s)

| Unit | Module | Class | Target |
|---|---|---|---|
| `google_firebase_project.default` | — | MANUAL_REVIEW / LOW | — |
| `google_pubsub_topic.faux` | — | REPLATFORM / MEDIUM | STACKIT RabbitMQ |
| `google_service_account.automation` | — | RECONFIGURE / MEDIUM | STACKIT service account |
| `google_service_account.client` | — | RECONFIGURE / MEDIUM | STACKIT service account |
| `google_service_account.server` | — | RECONFIGURE / MEDIUM | STACKIT service account |
| `google_sql_database_instance.postgres` | — | REPLATFORM / MEDIUM | STACKIT PostgreSQL Flex |

## Wave 2 — 2 unit(s)

| Unit | Module | Class | Target |
|---|---|---|---|
| `google_secret_manager_secret.django_admin_password` | — | RECONFIGURE / MEDIUM | STACKIT Secrets Manager |
| `google_storage_bucket.media` | — | RECONFIGURE / MEDIUM | STACKIT Object Storage |

## Wave 3 — 1 unit(s)

| Unit | Module | Class | Target |
|---|---|---|---|
| `google_secret_manager_secret.django_settings` | — | RECONFIGURE / MEDIUM | STACKIT Secrets Manager |

## Wave 4 — 2 unit(s)

| Unit | Module | Class | Target |
|---|---|---|---|
| `google_cloud_run_v2_job.migrate` | — | CONTAINERIZE / MEDIUM | Kubernetes Job/CronJob on SKE |
| `google_cloud_run_v2_service.server` | — | CONTAINERIZE / MEDIUM | SKE workload (or Cloud Foundry Docker app) |

## Cutover (decision support — performed by the customer)

No cutover facts: the scan and the draft established no DNS record set whose value the draft re-binds to a generated address, no public address re-binding, no DNS record unit, no certificate unit and no open cutover decision. That is not a statement that nothing has to be cut over: a name, an address or a certificate outside the scanned source is not seen, and a unit that exists only if OpenTofu decides so at plan time is not read here. StackToIT performs no cutover and gives no time estimate.

## Before wave 1

- [ ] Every prerequisite above is resolved (module vendored or `tofu init` run, count/for_each inputs known) and the assessment is run again.
- [ ] Architect has reviewed every MANUAL_REVIEW, REDESIGN and BLOCKED unit in engineering/architect-report.md.
- [ ] STACKIT organisation, folders and projects are laid out (one project per environment is the usual start).
- [ ] Data-transfer method and cutover window agreed per data unit (databases, buckets, caches).