fix(stackit): add the moved blocks the landing zone refactor missed - #256
Merged
Conversation
Unifying the sandbox and hub-and-spoke architectures into stackit-landingzone renamed three resources without moved blocks, so every landing zone deployed against an older ref destroys and recreates them on the next building block run: - stackit_resourcemanager_project.backplane -> .foundation, in the reference architecture. The project holds the project-creation service account, which module.backplane keys on its project id and which every tenant project names as its owner_email. name carries no RequiresReplace, so the -backplane -> -foundation rename updates in place once the address is moved. - meshstack_landingzone.stackit_default -> .this["default"], in modules/stackit. The landing zone keeps its metadata.name, so this is a pure state move, but tenants are assigned to it. - meshstack_building_block_definition.this -> .this["default"], in modules/stackit. Every tenant project building block instantiates this definition. The latter two gained for_each = local.project_variants when the networked variant was added, and the default key holds what the unkeyed resource held. Moving an unkeyed resource into a for_each key plans as no change, and both roots validate. For fresh deployments the moves are no-ops, because a move from an address that state does not hold does nothing. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Contributor
Scorecard CheckNo module changes detected relative to |
grubmeshi
added a commit
to meshcloud/trial-cloudfoundation
that referenced
this pull request
Aug 13, 2026
The hub merged reference-architectures/stackit-sandbox-landingzone and stackit-hub-spoke into one stackit-landingzone that takes an optional `network`, so a93aba0 has no directory at the old source path and `tofu init` fails on it. Leaving `network` unset keeps this deployment sandbox-only. The rename came without moved blocks, which would have destroyed and recreated three resources in the building block run: the backplane project holding the project-creation service account, the landing zone its tenants are assigned to, and the `STACKIT Project` definition every tenant project instantiates. meshcloud/meshstack-hub#256 adds them, and this pins f656771 rather than a93aba0. Planned against live state: 0 to add, 2 to change, 0 to destroy. Both changes are in place, the definition and the building block instance. The instance also carries the role_mapping change from 41a82cc, which was committed but never applied.
|
This pull request is automatically being deployed by Amplify Hosting (learn more). |
grubmeshi
pushed a commit
to meshcloud/trial-cloudfoundation
that referenced
this pull request
Aug 14, 2026
This should fix custom metering not working moving forward: a93aba0 adds the metering object to the STACKIT platform, without which meshStack generates no TURPs from pushed resource usage reports. The hub merged reference-architectures/stackit-sandbox-landingzone and stackit-hub-spoke into one stackit-landingzone that takes an optional `network`, so there is no directory at the old source path any more and `tofu init` fails on it. Leaving `network` unset keeps this deployment sandbox-only. That rename came without moved blocks, which would have destroyed and recreated three resources in the building block run: the backplane project holding the project-creation service account, the landing zone its tenants are assigned to, and the `STACKIT Project` definition every tenant project instantiates. None of them live in this repo's state, so meshcloud/meshstack-hub#256 adds the moved blocks and this pins f656771 rather than a93aba0. Re-pin once that merges. The role mapping comment from 41a82cc is corrected while we are here. It said `owner` had to go because it permits deleting the project out from under meshStack. `stackit project role list` says otherwise: `editor` carries resource-manager.project.delete just as `owner` does. What the cap does buy is iam.member.add, iam.role.add and the per-product role-binding permissions, without which a tenant cannot grant STACKIT access to people meshStack does not know about. The deletion gap is now recorded as a known gap, together with why a custom role is not worth the 808 permission names it would take to close it. Planned against live state: 0 to add, 2 to change, 0 to destroy. Both changes are in place, the definition and the building block instance. The instance also carries the role_mapping change from 41a82cc, which was committed but never applied. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
grubmeshi
pushed a commit
to meshcloud/trial-cloudfoundation
that referenced
this pull request
Aug 14, 2026
This should fix custom metering not working moving forward: the hub adds the metering object to the STACKIT platform, without which meshStack generates no TURPs from pushed resource usage reports. The hub merged reference-architectures/stackit-sandbox-landingzone and stackit-hub-spoke into one stackit-landingzone that takes an optional `network`, so there is no directory at the old source path any more and `tofu init` fails on it. Leaving `network` unset keeps this deployment sandbox-only. That rename came without moved blocks, which would have destroyed and recreated three resources in the building block run: the backplane project holding the project-creation service account, the landing zone its tenants are assigned to, and the `STACKIT Project` definition every tenant project instantiates. None of them live in this repo's state, so meshcloud/meshstack-hub#256 adds the moved blocks and this pins f656771 rather than a93aba0, the tip of hub main. Re-pin once #256 merges. Planned against live state: 0 to add, 2 to change, 0 to destroy. Both changes are in place, the definition and the building block instance. The instance also carries the role_mapping change from 41a82cc, which was committed but never applied. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The unification of
stackit-sandbox-landingzoneandstackit-hub-spokeintostackit-landingzone(#0ef0fdd) renamed three resources but shipped nomovedblocks. Any landing zone deployed against an older ref destroys and recreates them on its next building block run.Found while taking over meshcloud/trial-cloudfoundation#9, which bumps the trial foundation from
942edaftoa93aba0.stackit_resourcemanager_project.backplanestackit_resourcemanager_project.foundationmodule.backplanekeys it on the project id, and every tenant project names it asowner_email.meshstack_landingzone.stackit_defaultmeshstack_landingzone.this["default"]metadata.nameis unchanged, so the destroy and create collide on the same name.meshstack_building_block_definition.thismeshstack_building_block_definition.this["default"]The latter two gained
for_each = local.project_variantswhen thenetworkedvariant was added; thedefaultkey holds what the unkeyed resource held.Checks
stackit_resourcemanager_project.namehas noRequiresReplacein the provider, so the-backplane→-foundationrename updates in place once the address moves.for_eachkey plans as0 to add, 0 to change, 0 to destroy(checked on tofu withterraform_data).tofu validate, andtofu fmtis clean.🤖 Generated with Claude Code