Migration Plan
Waves, prerequisites, data movement and the order of work.
Migration Execution
Partially executable migration package. Migration-ready: NO — 72 critical settings of 16 source resources have manual or refused steps open (65 manual, 2 refused, 5 with no step); 26 steps of the plan cannot be carried out now (24 wait only for a decision, 2 are refused).
Steps defined: 78. Progress by kind of step: steps to answer: 24 · changes executable now: 5 · waiting: 47 (10 wait for a value); 2 refused (of 78 steps). 10 of the 12 automated steps (OpenTofu or a script) are free of decisions and manual prerequisites (2 require a design decision) · 0 can run as written · 10 of those 10 wait for a value (project_id, containers_machine_type, containers_nodes_max, containers_nodes_min and 7 more); a person can start 29 of the 64 manual steps now (10 wait for a manual prerequisite, 3 wait for an automated step, 22 require a design decision); 2 steps of the plan are permanently unsupported (refused). Some steps cannot be carried out as the plan stands, whatever is decided. Execution completeness: COMPLETE (each of the 64 manual steps states what it is, why, who carries it out and when it is done, and the input it needs where it depends on one).
42 of the 78 steps can be started now, by a tool or by a person; 10 of the automated ones wait for a value first; 10 wait for a manual prerequisite; 24 wait for a decision; 2 are refused: the target has nothing that carries the capability safely.
Three measures, not one: "can run as written" means the step is free of decisions and manual prerequisites and waits for no value (0 of the 12 automated steps); "automation-eligible" means the critical settings of the unit are closed (0 of 11 units; 11 cannot be automated in this build: a provider the build cannot check (11 units) and 5 more reasons, every one on the Automation eligibility line of index.html); "waiting for a value" means the step is free of decisions and manual prerequisites and reads a variable that has no value yet, so a person supplies it before the step runs and the step is never approved before (10 of the 10 steps free of decisions and manual prerequisites: the plan lists 11 OpenTofu variables, the STACKIT project id among them, with no value).
First blocker: Allow the calls of STACKIT APIs that are not generally available: open input (first because 2 automated steps wait for it).
Proposed, switched off
The draft holds these STACKIT alternatives as modules that are off. They are no step of the plan and no count here holds them: a plan of the draft holds nothing of one until a person decides on it, gives it its values and sets its switch to true.
| Label | Source | Module and switch | Not equal to the source | What you decide |
|---|---|---|---|---|
| Proposed | google_cloudbuild_trigger.activategcb | terraform/proposals/proposal_activategcb, proposal_activategcb_enabled | Nothing is converted. The same delivery is a workflow of STACKIT Git Pipelines (written for GitHub Actions; STACKIT-managed or custom runners; secrets from Secrets Manager or the repository; a manual-approval action) or the customer's own CI/CD. Trigger conditions, steps, secrets (created again, never copied), the service account (replaced by the credentials the workflow uses against STACKIT), the log destination and the approval are written again by a person. Not carried: the source repeats this resource and the module writes it once: give each instance its own design Not carried: build.options.logging: no value of the source is copied: the module asks the customer for the settings the pinned provider requires of its resources (name), and every other setting is the customer's to add Not carried: build.step.id: no value of the source is copied: the module asks the customer for the settings the pinned provider requires of its resources (name), and every other setting is the customer's to add Not carried: build.step.name: the name of the resource on STACKIT is the customer's value, and nothing is copied from the source name Not carried: build.step.script: no value of the source is copied: the module asks the customer for the settings the pinned provider requires of its resources (name), and every other setting is the customer's to add Not carried: description: the module takes no value of the source: give the value in the values if it is wanted Not carried: location: a region of the source is not copied: the module runs in the region the provider of the draft sets, or the one given in the values where it has a setting for it Not carried: name: the name of the resource on STACKIT is the customer's value, and nothing is copied from the source name Not carried: pubsub_config.topic: no value of the source is copied: the module asks the customer for the settings the pinned provider requires of its resources (name), and every other setting is the customer's to add Not carried: service_account: no value of the source is copied: the module asks the customer for the settings the pinned provider requires of its resources (name), and every other setting is the customer's to add | Which pipelines are still needed, where they run (STACKIT Git Pipelines or the customer's own CI/CD), how each trigger, step, secret and approval is written again, and who owns the workflow files. |
| Proposed | google_storage_bucket_iam_member.automation, beside the draft of google_storage_bucket.media | terraform/proposals/proposal_automation, proposal_automation_enabled | A STACKIT credentials group is not a grant on the Cloud Storage bucket. It is the principal that a bucket policy names, a set of S3 keys with no Google identity behind it, and by itself it gives no access to the bucket and takes none away. The statement that grants it something is a statement of the bucket policy, in the policy language of STACKIT (a credentials group or * as the principal, S3 actions, five condition keys), which no Terraform resource sets. The Google role is not mapped to S3 actions by any table, the condition of the grant has no counterpart unless it can be written with those five condition keys, and a Google group, a domain, a federated identity and allUsers or allAuthenticatedUsers are named again as credentials groups or as *. Not carried: member: no value of the source is copied: the module asks the customer for the settings the pinned provider requires of its resources (name), and every other setting is the customer's to add Not carried: role: no value of the source is copied: the module asks the customer for the settings the pinned provider requires of its resources (name), and every other setting is the customer's to add | Which credentials group stands for each member of the grant, which S3 actions of the bucket policy give the same people the access they need and no more than the Google role gave, what becomes of the condition, of public members (allUsers, allAuthenticatedUsers), of Google groups, domains and federated identities, and whether the grant ends with the Cloud Storage bucket when it has no replacement. Which bucket the grant is on, because the scan does not hold it. |
| Proposed | google_firebase_hosting_site.client | terraform/proposals/proposal_client, proposal_client_enabled | Static files are published into an Object Storage bucket by a pipeline, and a CDN distribution (a beta resource) with the bucket as origin serves them on a custom domain; the redirects of the site become redirect rules of the distribution. Custom response headers, rewrites to Cloud Run services or Cloud Functions, preview channels and the release history have no counterpart and are restated in the pipeline or in the application. Not carried: the source repeats this resource and the module writes it once: give each instance its own design Not carried: project: the module is written for the project of the draft Not carried: site_id: no value of the source is copied: the module asks the customer for the settings the pinned provider requires of its resources (objectstorage_bucket_name, cdn_distribution_config, cdn_custom_domain_distribution_id, cdn_custom_domain_name), and every other setting is the customer's to add | Which bucket is the origin, which domain the distribution serves, and how rewrites and previews are replaced. The CDN resources are beta. |
| Proposed | google_secret_manager_secret_iam_binding.django_admin_password, beside the draft of google_secret_manager_secret.django_admin_password | terraform/proposals/proposal_django_admin_password, proposal_django_admin_password_enabled | A STACKIT role assignment is not a grant on the Secret Manager secret. It gives one user, group or service account one STACKIT role on a whole project, folder or organisation. The role is a set of STACKIT permissions, not the Google role, and no table maps one to the other. It has no condition and no public member, so what the grant gave to a Google group, a domain, a federated identity or everyone is named again, and the access reaches more than the Secret Manager secret. A binding on a secret group applies to every secret in the group, so it is wider than a grant on one secret unless the secret has a group of its own, and its roles are Secrets Manager roles. The binding was authoritative for its role: STACKIT role assignments are additive, so a person who holds the role through another assignment keeps it, and removing such people is a step of a person. Not carried: members: no value of the source is copied: the module asks the customer for the settings the pinned provider requires of its resources (authorization_project_role_assignment_resource_id, authorization_project_role_assignment_role, authorization_project_role_assignment_subject, authorization_folder_role_assignment_resource_id, authorization_folder_role_assignment_role, authorization_folder_role_assignment_subject, authorization_organization_role_assignment_resource_id, authorization_organization_role_assignment_role and 7 more), and every other setting is the customer's to add Not carried: role: no value of the source is copied: the module asks the customer for the settings the pinned provider requires of its resources (authorization_project_role_assignment_resource_id, authorization_project_role_assignment_role, authorization_project_role_assignment_subject, authorization_folder_role_assignment_resource_id, authorization_folder_role_assignment_role, authorization_folder_role_assignment_subject, authorization_organization_role_assignment_resource_id, authorization_organization_role_assignment_role and 7 more), and every other setting is the customer's to add | Which STACKIT role, on which project, folder or organisation, gives the same people the access they need on the Secret Manager secret, knowing it covers everything in that scope; which STACKIT users, groups or service accounts take the place of Google groups, domains, federated identities and a public member; and whether the grant ends with the Secret Manager secret when it has no replacement. For secrets: which secret group holds the secret, who else shares that group, and which Secrets Manager role and subject take the grant. Whether people who hold the role through another assignment keep it. |
| Proposed | google_secret_manager_secret_iam_binding.django_settings, beside the draft of google_secret_manager_secret.django_settings | terraform/proposals/proposal_django_settings, proposal_django_settings_enabled | A STACKIT role assignment is not a grant on the Secret Manager secret. It gives one user, group or service account one STACKIT role on a whole project, folder or organisation. The role is a set of STACKIT permissions, not the Google role, and no table maps one to the other. It has no condition and no public member, so what the grant gave to a Google group, a domain, a federated identity or everyone is named again, and the access reaches more than the Secret Manager secret. A binding on a secret group applies to every secret in the group, so it is wider than a grant on one secret unless the secret has a group of its own, and its roles are Secrets Manager roles. The binding was authoritative for its role: STACKIT role assignments are additive, so a person who holds the role through another assignment keeps it, and removing such people is a step of a person. Not carried: members: no value of the source is copied: the module asks the customer for the settings the pinned provider requires of its resources (authorization_project_role_assignment_resource_id, authorization_project_role_assignment_role, authorization_project_role_assignment_subject, authorization_folder_role_assignment_resource_id, authorization_folder_role_assignment_role, authorization_folder_role_assignment_subject, authorization_organization_role_assignment_resource_id, authorization_organization_role_assignment_role and 7 more), and every other setting is the customer's to add Not carried: role: no value of the source is copied: the module asks the customer for the settings the pinned provider requires of its resources (authorization_project_role_assignment_resource_id, authorization_project_role_assignment_role, authorization_project_role_assignment_subject, authorization_folder_role_assignment_resource_id, authorization_folder_role_assignment_role, authorization_folder_role_assignment_subject, authorization_organization_role_assignment_resource_id, authorization_organization_role_assignment_role and 7 more), and every other setting is the customer's to add | Which STACKIT role, on which project, folder or organisation, gives the same people the access they need on the Secret Manager secret, knowing it covers everything in that scope; which STACKIT users, groups or service accounts take the place of Google groups, domains, federated identities and a public member; and whether the grant ends with the Secret Manager secret when it has no replacement. For secrets: which secret group holds the secret, who else shares that group, and which Secrets Manager role and subject take the grant. Whether people who hold the role through another assignment keep it. |
| Proposed | google_cloudbuild_trigger.init | terraform/proposals/proposal_init, proposal_init_enabled | Nothing is converted. The same delivery is a workflow of STACKIT Git Pipelines (written for GitHub Actions; STACKIT-managed or custom runners; secrets from Secrets Manager or the repository; a manual-approval action) or the customer's own CI/CD. Trigger conditions, steps, secrets (created again, never copied), the service account (replaced by the credentials the workflow uses against STACKIT), the log destination and the approval are written again by a person. Not carried: the source repeats this resource and the module writes it once: give each instance its own design Not carried: build.options.logging: no value of the source is copied: the module asks the customer for the settings the pinned provider requires of its resources (name), and every other setting is the customer's to add Not carried: build.step.id: no value of the source is copied: the module asks the customer for the settings the pinned provider requires of its resources (name), and every other setting is the customer's to add Not carried: build.step.name: the name of the resource on STACKIT is the customer's value, and nothing is copied from the source name Not carried: build.step.script: no value of the source is copied: the module asks the customer for the settings the pinned provider requires of its resources (name), and every other setting is the customer's to add Not carried: description: the module takes no value of the source: give the value in the values if it is wanted Not carried: location: a region of the source is not copied: the module runs in the region the provider of the draft sets, or the one given in the values where it has a setting for it Not carried: name: the name of the resource on STACKIT is the customer's value, and nothing is copied from the source name Not carried: pubsub_config.topic: no value of the source is copied: the module asks the customer for the settings the pinned provider requires of its resources (name), and every other setting is the customer's to add Not carried: service_account: no value of the source is copied: the module asks the customer for the settings the pinned provider requires of its resources (name), and every other setting is the customer's to add | Which pipelines are still needed, where they run (STACKIT Git Pipelines or the customer's own CI/CD), how each trigger, step, secret and approval is written again, and who owns the workflow files. |
| Proposed | google_cloudbuild_trigger.placeholder | terraform/proposals/proposal_placeholder, proposal_placeholder_enabled | Nothing is converted. The same delivery is a workflow of STACKIT Git Pipelines (written for GitHub Actions; STACKIT-managed or custom runners; secrets from Secrets Manager or the repository; a manual-approval action) or the customer's own CI/CD. Trigger conditions, steps, secrets (created again, never copied), the service account (replaced by the credentials the workflow uses against STACKIT), the log destination and the approval are written again by a person. Not carried: the source repeats this resource and the module writes it once: give each instance its own design Not carried: build.options.logging: no value of the source is copied: the module asks the customer for the settings the pinned provider requires of its resources (name), and every other setting is the customer's to add Not carried: build.step.env: no value of the source is copied: the module asks the customer for the settings the pinned provider requires of its resources (name), and every other setting is the customer's to add Not carried: build.step.id: no value of the source is copied: the module asks the customer for the settings the pinned provider requires of its resources (name), and every other setting is the customer's to add Not carried: build.step.name: the name of the resource on STACKIT is the customer's value, and nothing is copied from the source name Not carried: description: the module takes no value of the source: give the value in the values if it is wanted Not carried: location: a region of the source is not copied: the module runs in the region the provider of the draft sets, or the one given in the values where it has a setting for it Not carried: name: the name of the resource on STACKIT is the customer's value, and nothing is copied from the source name Not carried: pubsub_config.topic: no value of the source is copied: the module asks the customer for the settings the pinned provider requires of its resources (name), and every other setting is the customer's to add Not carried: service_account: no value of the source is copied: the module asks the customer for the settings the pinned provider requires of its resources (name), and every other setting is the customer's to add | Which pipelines are still needed, where they run (STACKIT Git Pipelines or the customer's own CI/CD), how each trigger, step, secret and approval is written again, and who owns the workflow files. |
| Proposed | google_storage_bucket_iam_member.server, beside the draft of google_storage_bucket.media | terraform/proposals/proposal_server, proposal_server_enabled | A STACKIT credentials group is not a grant on the Cloud Storage bucket. It is the principal that a bucket policy names, a set of S3 keys with no Google identity behind it, and by itself it gives no access to the bucket and takes none away. The statement that grants it something is a statement of the bucket policy, in the policy language of STACKIT (a credentials group or * as the principal, S3 actions, five condition keys), which no Terraform resource sets. The Google role is not mapped to S3 actions by any table, the condition of the grant has no counterpart unless it can be written with those five condition keys, and a Google group, a domain, a federated identity and allUsers or allAuthenticatedUsers are named again as credentials groups or as *. Not carried: member: no value of the source is copied: the module asks the customer for the settings the pinned provider requires of its resources (name), and every other setting is the customer's to add Not carried: role: no value of the source is copied: the module asks the customer for the settings the pinned provider requires of its resources (name), and every other setting is the customer's to add | Which credentials group stands for each member of the grant, which S3 actions of the bucket policy give the same people the access they need and no more than the Google role gave, what becomes of the condition, of public members (allUsers, allAuthenticatedUsers), of Google groups, domains and federated identities, and whether the grant ends with the Cloud Storage bucket when it has no replacement. Which bucket the grant is on, because the scan does not hold it. |
Why some units are not carried by Terraform or the STACKIT API
16 units that Terraform and the STACKIT API do not carry are counted here once each, under one reason. Whatever else is open on a unit is in execution-plan.json.
The reasons and their units
| Reason | Units |
|---|---|
| STACKIT has a counterpart, but it does not do something these units rely on. | google_cloud_run_v2_job.migrate, google_cloud_run_v2_service.server, google_storage_bucket.media |
| They need a different design on STACKIT, which an architect has to decide. | google_cloudbuild_trigger.activategcb, google_cloudbuild_trigger.init, google_cloudbuild_trigger.placeholder, google_firebase_hosting_site.client |
| A decision of yours is open. | google_pubsub_topic.faux, google_secret_manager_secret.django_admin_password, google_secret_manager_secret.django_settings, google_sql_database_instance.postgres |
| The assessment is not finished: a setting is still open for review, which says nothing yet about whether STACKIT can carry them. | google_firebase_project.default, google_service_account.automation, google_service_account.client, google_service_account.init, google_service_account.server |
How far the migration can be carried out as it stands, read from execution-plan.json: the steps the draft is made of, how each is carried out and what each waits for. Nothing in it has been run, and nothing here approves it or says it is safe to apply.
The Work Board lists every job of these steps in four queues (provide information, approve a design, perform migration work, verify): who does it, what it waits for and what closes it.
| How | Steps |
|---|---|
| OpenTofu steps | 10 |
| STACKIT API calls | 2 (2 generated, tested offline) |
| Manual steps | 64 |
| Refused | 2 |
| All steps | 78 |
How far each STACKIT API step has come
2 STACKIT API steps, each with its state and what the state means
A STACKIT API step is a script a person runs; its state says what StackToIT has done with it and never more. StackToIT has run none of them. Only “verified live” rests on a call to the live STACKIT API; any other state means the operator checks the endpoint, the project and the read before the write, as the header of the script lists, before running it. The state changes nothing about how a step is carried out: an alpha or beta API still waits for its opt-in decision, and the checks a script makes itself (the read before the write, the confirmation) are the same.
| Step | Call | State | What the state means |
|---|---|---|---|
API/secrets-manager-vault/WriteSecret/google_secret_manager_secret.django_admin_password | secrets-manager-vault WriteSecret | generated, tested offline | A test of StackToIT ran a script of this call under a real shell against a local stub that answers as the API is documented to; it was not run against the live STACKIT API. |
API/secrets-manager-vault/WriteSecret/google_secret_manager_secret.django_settings | secrets-manager-vault WriteSecret | generated, tested offline | A test of StackToIT ran a script of this call under a real shell against a local stub that answers as the API is documented to; it was not run against the live STACKIT API. |
Every one of the 10 resource and data blocks of the Terraform draft is a step of this plan.
Manual work packages
24 manual work packages: the owner, the steps, the decisions and the state of each
The manual steps, grouped into work packages: the steps of one phase that one role carries out together, of one kind of work. A package is as far as its least advanced step. execution/manual/actions.md lists each package with its steps.
| Package | What | Owner | Steps | Affected resources | Decisions to answer | State |
|---|---|---|---|---|---|---|
WP-01 | Set up the identities and access (prepare) | Identity Architect | 4 | 4 | — | a person can start it now |
WP-02 | Decide and set the critical settings (security) | Identity Architect | 6 | 6 | — | steps to answer: a person answers them, no change is made |
WP-03 | Decide and set the critical settings (security) | Security Architect | 2 | 2 | — | steps to answer: a person answers them, no change is made |
WP-04 | Secrets migration user retire (security) | Security Architect | 1 | 2 | DEC-GEN-CONVERT-API-OPT-IN | waits for decisions |
WP-05 | Secrets read back (security) | Security Architect | 1 | 2 | DEC-GEN-CONVERT-API-OPT-IN | waits for decisions |
WP-06 | Decide and set the critical settings (data services) | Identity Architect | 2 | 2 | — | steps to answer: a person answers them, no change is made |
WP-07 | Decide and set the critical settings (data services) | Network Architect | 1 | 1 | — | steps to answer: a person answers them, no change is made |
WP-08 | Decide and set the critical settings (data services) | Platform Architect | 4 | 4 | DEC-GEN-CONVERT-SOURCE-PROJECT-MAPPING, DEC-GEN-CONVERT-SOURCE-REGION-MAPPING | waits for decisions (2 of 4 manual steps) |
WP-09 | Decide and set the critical settings (data services) | Security Architect | 1 | 1 | — | steps to answer: a person answers them, no change is made |
WP-10 | Decide and set the critical settings (data services) | Storage Architect | 1 | 1 | — | steps to answer: a person answers them, no change is made |
WP-11 | Decide on the switched-off modules that hold a STACKIT alternative of what has no equal (data services) | Network Architect | 1 | 1 | DEC-GEN-CONVERT-PROPOSED-ALTERNATIVE | waits for decisions |
WP-12 | Move the data and the objects to the target | Data Architect | 8 | 2 | DEC-GEN-CONVERT-DATA-MOVEMENT | waits for decisions (2 of 8 manual steps) |
WP-13 | Decide and set the critical settings (platform services) | Identity Architect | 2 | 2 | — | steps to answer: a person answers them, no change is made |
WP-14 | Decide and set the critical settings (platform services) | Network Architect | 2 | 2 | — | steps to answer: a person answers them, no change is made |
WP-15 | Decide and set the critical settings (platform services) | Platform Architect | 3 | 3 | — | steps to answer: a person answers them, no change is made |
WP-16 | Decide and set the critical settings (platform services) | Security Architect | 2 | 2 | — | steps to answer: a person answers them, no change is made |
WP-17 | Carry by hand what the STACKIT service for pubsub topic does not take from the draft (platform services) | Platform Architect | 1 | 1 | DEC-GEN-CONVERT-API-OPT-IN | waits for decisions |
WP-18 | Cluster access (platform services) | Platform Architect | 1 | 2 | — | a person can start it after the automated step it comes after has run |
WP-19 | Messaging topology (platform services) | Platform Engineer | 1 | 1 | — | a person can start it now |
WP-20 | Decide on the switched-off modules that hold a STACKIT alternative of what has no equal (workloads) | Platform Architect | 3 | 3 | DEC-GEN-CONVERT-PROPOSED-ALTERNATIVE | waits for decisions |
WP-21 | Kubernetes apply (workloads) | Platform Architect | 2 | 2 | — | a person can start after WP-18 is done |
WP-22 | Move the data and the objects to the target | Data Architect | 8 | 2 | DEC-GEN-CONVERT-DATA-MOVEMENT | waits for decisions (6 of 8 manual steps) |
WP-23 | Move the data and the objects to the target | Migration Owner | 4 | 2 | DEC-GEN-CONVERT-DATA-MOVEMENT | waits for decisions (3 of 4 manual steps) |
WP-24 | Retire the source resources | Data Architect | 3 | 2 | DEC-GEN-CONVERT-DATA-MOVEMENT | waits for decisions (2 of 3 manual steps) |
Values the manual steps still need
20 values the manual steps still need, in 2 steps
The values a data move, its checks and its way back need that the plan cannot read from the source: each with the role that supplies it and the condition that closes it. execution/manual/actions.md lists them with each step.
The data preflight of google_storage_bucket.media MAN/data/google_storage_bucket.media/preflight
- copy volume: UNKNOWN — supplied by Data Architect (the amount of data of google_storage_bucket.media to copy: the used space measured on the source; the provisioned capacity of the source is not the amount of data; closed when the measured amount and the date of the measurement are recorded)
- change rate: UNKNOWN — supplied by Data Architect (how much data the writers of google_storage_bucket.media change per hour; closed when the rate measured over a representative period is recorded, with the time a final pass needs at that rate)
- write-freeze window: UNKNOWN — supplied by Data Architect (the window in which the writers of google_storage_bucket.media stop for the final pass; closed when the owner of the application agrees the start and the end of the window and it is recorded)
- last sync: UNKNOWN — supplied by Data Architect (the time the final pass ends and its checks hold; closed when the time of the final pass and the result of its checks are recorded)
- return point: UNKNOWN — supplied by Data Architect (the state of google_storage_bucket.media the migration returns to on a rollback: the source as it was at the write freeze, or a named snapshot or backup; closed when the return point is recorded with its time and how it is restored)
- consistency check: UNKNOWN — supplied by Data Architect (how the copy of google_storage_bucket.media is shown complete and unchanged after the final pass: the used space and a checksum of the data (of the files, or the row counts of the tables) agree with the source; closed when the method is agreed and its result after the final pass is recorded)
- validation on the target: UNKNOWN — supplied by Migration Owner (the test the application that uses google_storage_bucket.media passes on STACKIT with the copied data before the cutover, agreed with the owner of the application; closed when the test passes on the target and its result is recorded)
- source retention: UNKNOWN — supplied by Migration Owner (google_storage_bucket.media is not retired until the owner decides to retire it; how long it and its final backup are kept after that is the owner's; closed when the date until which google_storage_bucket.media is kept is recorded)
- rollback trigger: UNKNOWN — supplied by Migration Owner (the owner's decision to go back; the criteria that call it; closed when the criteria (which check fails, which metric passes which limit, by when) are recorded before the cutover)
- data written to the target: UNKNOWN — supplied by Data Architect (what is written on STACKIT after the switch is not in Google Cloud: it is copied back to google_storage_bucket.media before Google Cloud serves again, or accepted as lost; closed when the choice is recorded before the cutover)
The data preflight of google_sql_database_instance.postgres MAN/data/google_sql_database_instance.postgres/preflight
- copy volume: UNKNOWN — supplied by Data Architect (the amount of data of google_sql_database_instance.postgres to copy: the used space measured on the source; the provisioned capacity of the source is not the amount of data; closed when the measured amount and the date of the measurement are recorded)
- change rate: UNKNOWN — supplied by Data Architect (how much data the writers of google_sql_database_instance.postgres change per hour; closed when the rate measured over a representative period is recorded, with the time a final pass needs at that rate)
- write-freeze window: UNKNOWN — supplied by Data Architect (the window in which the writers of google_sql_database_instance.postgres stop for the final pass; closed when the owner of the application agrees the start and the end of the window and it is recorded)
- last sync: UNKNOWN — supplied by Data Architect (the time the final pass ends and its checks hold; closed when the time of the final pass and the result of its checks are recorded)
- return point: UNKNOWN — supplied by Data Architect (the state of google_sql_database_instance.postgres the migration returns to on a rollback: the source as it was at the write freeze, or a named snapshot or backup; closed when the return point is recorded with its time and how it is restored)
- consistency check: UNKNOWN — supplied by Data Architect (how the copy of google_sql_database_instance.postgres is shown complete and unchanged after the final pass: the used space and a checksum of the data (of the files, or the row counts of the tables) agree with the source; closed when the method is agreed and its result after the final pass is recorded)
- validation on the target: UNKNOWN — supplied by Migration Owner (the test the application that uses google_sql_database_instance.postgres passes on STACKIT with the copied data before the cutover, agreed with the owner of the application; closed when the test passes on the target and its result is recorded)
- source retention: UNKNOWN — supplied by Migration Owner (google_sql_database_instance.postgres is not retired until the owner decides to retire it; how long it and its final backup are kept after that is the owner's; closed when the date until which google_sql_database_instance.postgres is kept is recorded)
- rollback trigger: UNKNOWN — supplied by Migration Owner (the owner's decision to go back; the criteria that call it; closed when the criteria (which check fails, which metric passes which limit, by when) are recorded before the cutover)
- data written to the target: UNKNOWN — supplied by Data Architect (what is written on STACKIT after the switch is not in Google Cloud: it is copied back to google_sql_database_instance.postgres before Google Cloud serves again, or accepted as lost; closed when the choice is recorded before the cutover)
Decisions that hold steps back
5 decisions hold steps back
Each is described in the record of the same id on the Decisions page.
DEC-GEN-CONVERT-API-OPT-INholds back 5 steps of the planDEC-GEN-CONVERT-DATA-MOVEMENTholds back 13 steps of the planDEC-GEN-CONVERT-PROPOSED-ALTERNATIVEholds back 4 steps of the planDEC-GEN-CONVERT-SOURCE-PROJECT-MAPPINGholds back 1 step of the planDEC-GEN-CONVERT-SOURCE-REGION-MAPPINGholds back 1 step of the plan
The execution package
5 files of the execution package, a rendering of the plan and of nothing else
Start with the first file.
execution/README.md— where to start: what is created, what cannot be migrated, the decisions, the credentials, the order of the steps, the checks and the rollbackexecution/terraform/apply.md— the OpenTofu steps and the commands that carry them outexecution/manual/actions.md— the steps a person does, and what is not migratedexecution/verify/checks.md— the checks to make before and after each stepmigration/execution-actions.csv— one row per step, for a spreadsheet
Migration documents
2 migration documents
migration/roadmap.md— the steps laid out in waves, from the decisions to the decommissionmigration/landing-zone-requirements.md— what the STACKIT organization and project have to provide before the first apply
Technical sequencing
The waves, from the dependencies between the units (migration/technical-sequencing.md): a technical order, not a schedule
The run wrote migration/technical-sequencing.md.
It holds the waves computed from the dependencies between the units: a unit comes after every unit it depends on, and the units of one wave do not depend on each other. That is a technical order only. It is not a schedule, it does not rank the units by what the business needs first, and nothing in it has been checked against the data or the applications.
Not assessed in this build: whether a wave can start, who runs it and when. What stands in the way of the units is listed on the Decisions page and, as deployment prerequisites, on the Architecture page.