From f656771c31a38c548b7cef540dc97b6a8754e49e Mon Sep 17 00:00:00 2001 From: Andreas Grub Date: Thu, 13 Aug 2026 22:35:10 +0200 Subject: [PATCH] fix(stackit): add the moved blocks the landing zone refactor missed Unifying the sandbox and hub-and-spoke architectures into stackit-landingzone renamed three resources without moved blocks, so every landing zone deployed against an older ref destroys and recreates them on the next building block run: - stackit_resourcemanager_project.backplane -> .foundation, in the reference architecture. The project holds the project-creation service account, which module.backplane keys on its project id and which every tenant project names as its owner_email. name carries no RequiresReplace, so the -backplane -> -foundation rename updates in place once the address is moved. - meshstack_landingzone.stackit_default -> .this["default"], in modules/stackit. The landing zone keeps its metadata.name, so this is a pure state move, but tenants are assigned to it. - meshstack_building_block_definition.this -> .this["default"], in modules/stackit. Every tenant project building block instantiates this definition. The latter two gained for_each = local.project_variants when the networked variant was added, and the default key holds what the unkeyed resource held. Moving an unkeyed resource into a for_each key plans as no change, and both roots validate. For fresh deployments the moves are no-ops, because a move from an address that state does not hold does nothing. Co-Authored-By: Claude Opus 5 (1M context) --- modules/stackit/meshstack_integration.tf | 14 ++++++++++++++ .../stackit-landingzone/buildingblock/main.tf | 11 +++++++++++ 2 files changed, 25 insertions(+) diff --git a/modules/stackit/meshstack_integration.tf b/modules/stackit/meshstack_integration.tf index ce9a0f5e..bc1af692 100644 --- a/modules/stackit/meshstack_integration.tf +++ b/modules/stackit/meshstack_integration.tf @@ -395,6 +395,20 @@ resource "meshstack_building_block_definition" "this" { } } +# --- State address migrations (no resource recreation) --- +# Both resources gained `for_each = local.project_variants` when the `networked` project variant was +# added. The `default` key holds what the single, unkeyed resource used to hold. Without these moves +# a deployed integration destroys the landing zone its tenants are assigned to, and the `STACKIT +# Project` definition that every tenant project building block instantiates. +moved { + from = meshstack_landingzone.stackit_default + to = meshstack_landingzone.this["default"] +} +moved { + from = meshstack_building_block_definition.this + to = meshstack_building_block_definition.this["default"] +} + terraform { required_version = ">= 1.12.0" diff --git a/reference-architectures/stackit-landingzone/buildingblock/main.tf b/reference-architectures/stackit-landingzone/buildingblock/main.tf index 2f141a07..d4714ef9 100644 --- a/reference-architectures/stackit-landingzone/buildingblock/main.tf +++ b/reference-architectures/stackit-landingzone/buildingblock/main.tf @@ -36,6 +36,17 @@ resource "stackit_resourcemanager_project" "foundation" { parent_container_id = var.stackit_org } +# --- State address migration (no resource recreation) --- +# The sandbox landing zone called this project `backplane`. Unifying the sandbox and hub-and-spoke +# architectures renamed it to `foundation`, because it now holds more than the backplane service +# account. Without this move a deployed landing zone destroys the project, and with it the +# project-creation service account that every tenant project names as its owner. +# `name` carries no RequiresReplace, so the `-backplane` -> `-foundation` rename updates in place. +moved { + from = stackit_resourcemanager_project.backplane + to = stackit_resourcemanager_project.foundation +} + module "stackit_integration" { source = "github.com/meshcloud/meshstack-hub//modules/stackit?ref=${var.hub.git_ref}"