][] = [
{
...capabilities,
observability: { logs_retention_days: 14, acl: ["192.0.2.0/24"] },
+ bucket_naming: "project-id",
audit_logs: {
s3_object_lock: false,
link_scopes: [
diff --git a/landing-zone-configurator/app/scripts/verify-initial-plan-contract.mjs b/landing-zone-configurator/app/scripts/verify-initial-plan-contract.mjs
index c722321f..6e6a57b8 100644
--- a/landing-zone-configurator/app/scripts/verify-initial-plan-contract.mjs
+++ b/landing-zone-configurator/app/scripts/verify-initial-plan-contract.mjs
@@ -138,11 +138,15 @@ for (const event of plans) {
if (enabled("observability")) {
const instance = resources("stackit_observability_instance")[0].change
.after;
+ // Mock providers synthesize computed retention values. Assert the native
+ // input contract instead of mistaking a mock zero for a service default.
assert.equal(
- instance.logs_retention_days,
- name === "combined" ? 14 : 30,
+ event.test_plan.variables.observability.value.logs_retention_days ?? null,
+ name === "combined" ? 14 : null,
name,
);
+ if (name === "combined")
+ assert.equal(instance.logs_retention_days, 14, name);
assert.deepEqual(
instance.acl,
name === "combined" ? ["192.0.2.0/24"] : [],
diff --git a/landing-zone-configurator/app/tests/assistant-scenarios.test.ts b/landing-zone-configurator/app/tests/assistant-scenarios.test.ts
index f3d7a935..161d11cc 100644
--- a/landing-zone-configurator/app/tests/assistant-scenarios.test.ts
+++ b/landing-zone-configurator/app/tests/assistant-scenarios.test.ts
@@ -230,7 +230,13 @@ it.each(assistantScenarios)(
acl: ["203.0.113.0/24"],
s3_object_lock: false,
},
- observability: { metrics_retention_days: 30 },
+ observability: {
+ metrics_retention_days: 30,
+ ...(scenario.id === "editor-monitoring-retention"
+ ? { plan_name: "Observability-Monitoring-Medium-EU01" }
+ : {}),
+ },
+ bucket_naming: "project-id",
devops: {
git_flavor: "git-10",
allowed_network_ranges: ["203.0.113.0/24"],
diff --git a/landing-zone-configurator/app/tests/cloud-catalogues.test.ts b/landing-zone-configurator/app/tests/cloud-catalogues.test.ts
index 7067ef33..c64d2b6f 100644
--- a/landing-zone-configurator/app/tests/cloud-catalogues.test.ts
+++ b/landing-zone-configurator/app/tests/cloud-catalogues.test.ts
@@ -538,7 +538,13 @@ it("loads distinct IaaS bastion options and Observability plan names without sug
if (target.includes("argus.api"))
return Response.json({
plans: [
- { planId: "not-the-tf-input", name: "Observability-Starter-EU01" },
+ {
+ planId: "not-the-tf-input",
+ name: "Observability-Starter-EU01",
+ totalMetricSamples: 100,
+ logsStorage: 0,
+ tracesStorage: 0,
+ },
],
});
if (target.endsWith("/machine-types"))
@@ -578,6 +584,11 @@ it("loads distinct IaaS bastion options and Observability plan names without sug
{
value: "Observability-Starter-EU01",
label: "Observability-Starter-EU01",
+ capabilities: {
+ metricsRetention: true,
+ logsRetention: false,
+ tracesRetention: false,
+ },
},
]);
expect(result.bastionMachineTypes?.options[0]?.value).toBe("g2i.1");
diff --git a/landing-zone-configurator/app/tests/common-configuration.test.ts b/landing-zone-configurator/app/tests/common-configuration.test.ts
index ada6dd9d..ccb326ca 100644
--- a/landing-zone-configurator/app/tests/common-configuration.test.ts
+++ b/landing-zone-configurator/app/tests/common-configuration.test.ts
@@ -94,12 +94,12 @@ describe("shared accelerator feature contract", () => {
landing_zone_configurator: "true",
});
});
- it("assigns all 29 inputs exactly once, including every protected input", () => {
+ it("assigns all 30 inputs exactly once, including every protected input", () => {
const assigned = Object.values(featureGroups).flatMap((group) => [
...group.inputs,
]);
- expect(assigned.length).toBe(29);
- expect(new Set(assigned).size).toBe(29);
+ expect(assigned.length).toBe(30);
+ expect(new Set(assigned).size).toBe(30);
expect([...assigned].sort()).toEqual(
acceleratorInputs.map((input) => input.name).sort(),
);
@@ -489,3 +489,63 @@ describe("combination and execution boundaries", () => {
},
);
});
+
+it("keeps Monitoring retention nullable and rejects explicit log/trace overrides before execution", () => {
+ for (const retention of [
+ {},
+ { logs_retention_days: null, traces_retention_days: null },
+ ]) {
+ const document = setCommonInput(create(), "observability", {
+ plan_name: "Observability-Monitoring-Medium-EU01",
+ ...retention,
+ });
+ const effective = objectValue(
+ effectiveInput(values(document), "observability"),
+ );
+ expect(effective.logs_retention_days ?? null).toBeNull();
+ expect(effective.traces_retention_days ?? null).toBeNull();
+ expect(effective.metrics_retention_days ?? null).toBeNull();
+ expect(
+ assessCommonConfiguration(document).findings.some(
+ (finding) => finding.code === "unsupported-observability-retention",
+ ),
+ ).toBe(false);
+ }
+ const document = setCommonInput(create(), "observability", {
+ plan_name: "Observability-Monitoring-Medium-EU01",
+ logs_retention_days: 30,
+ traces_retention_days: 14,
+ });
+ expect(
+ assessCommonConfiguration(document)
+ .findings.filter(
+ (finding) => finding.code === "unsupported-observability-retention",
+ )
+ .map((finding) => finding.path),
+ ).toEqual([
+ "observability.logs_retention_days",
+ "observability.traces_retention_days",
+ ]);
+ expect(values(document).observability).toMatchObject({
+ logs_retention_days: 30,
+ traces_retention_days: 14,
+ });
+});
+
+it("uses project-qualified bucket naming by default and preserves explicit legacy selection", () => {
+ expect(effectiveInput(values(create()), "bucket_naming")).toBe("project-id");
+ const legacy = setCommonInput(create(), "bucket_naming", "legacy");
+ expect(values(legacy).bucket_naming).toBe("legacy");
+ expect(
+ assessCommonConfiguration(legacy).findings.some(
+ (finding) => finding.code === "invalid-bucket-naming",
+ ),
+ ).toBe(false);
+ const invalid = setCommonInput(create(), "bucket_naming", "unsupported");
+ expect(assessCommonConfiguration(invalid).findings).toContainEqual(
+ expect.objectContaining({
+ path: "bucket_naming",
+ code: "invalid-bucket-naming",
+ }),
+ );
+});
diff --git a/landing-zone-configurator/app/tests/local-runner.test.ts b/landing-zone-configurator/app/tests/local-runner.test.ts
index 1aeced6a..fceb40f5 100644
--- a/landing-zone-configurator/app/tests/local-runner.test.ts
+++ b/landing-zone-configurator/app/tests/local-runner.test.ts
@@ -80,7 +80,7 @@ async function fixture(
it("binds the explicit platform upgrade source into the package identity and rejects unknown sources", async () => {
const { root, jobs, runner } = await fixture();
- const upgrade = "c4b43c36af198985980b17626c48d357795e3fbd";
+ const upgrade = "9e7fb46c329aca32e878ce1f0ea3b944ea240354";
expect(runner.supportsAccelerator(upgrade)).toBe(false);
await writeFile(
join(root, "platform-source.json"),
diff --git a/landing-zone-configurator/app/tests/observability-plans.test.ts b/landing-zone-configurator/app/tests/observability-plans.test.ts
new file mode 100644
index 00000000..61a8cc0b
--- /dev/null
+++ b/landing-zone-configurator/app/tests/observability-plans.test.ts
@@ -0,0 +1,165 @@
+import {
+ type ObservabilityPlanCatalogue,
+ observabilityPlanCapabilities,
+ observabilityRetentionFindings,
+} from "@lzc/domain";
+import { expect, it } from "vitest";
+
+const live = (
+ value: string,
+ capabilities: {
+ metricsRetention?: boolean;
+ logsRetention?: boolean;
+ tracesRetention?: boolean;
+ },
+): ObservabilityPlanCatalogue => ({
+ region: "eu01",
+ fetchedAt: new Date().toISOString(),
+ observabilityPlans: {
+ status: "available",
+ options: [{ value, label: value, capabilities }],
+ },
+});
+it("rejects the failed Monitoring/logs combination offline and retains the supplied value", () => {
+ const settings = {
+ plan_name: "Observability-Monitoring-Medium-EU01",
+ logs_retention_days: 30,
+ metrics_retention_days: 90,
+ };
+ const result = observabilityRetentionFindings(settings);
+ expect(result.findings.map((finding) => finding.field)).toEqual([
+ "logs_retention_days",
+ ]);
+ expect(settings.logs_retention_days).toBe(30);
+ expect(result.capabilities.source).toBe("static");
+});
+it("uses explicit live zero capacities over a conflicting static plan family", () => {
+ const plan = "Observability-Starter-EU01";
+ const result = observabilityRetentionFindings(
+ { plan_name: plan, logs_retention_days: 5 },
+ live(plan, {
+ metricsRetention: true,
+ logsRetention: false,
+ tracesRetention: false,
+ }),
+ );
+ expect(result.capabilities.source).toBe("live");
+ expect(result.findings).toContainEqual(
+ expect.objectContaining({
+ field: "logs_retention_days",
+ code: "unsupported-observability-retention",
+ }),
+ );
+});
+it("accepts a new live plan and never fabricates missing capabilities", () => {
+ const name = "new-plan";
+ expect(
+ observabilityRetentionFindings(
+ { plan_name: name, logs_retention_days: 7 },
+ live(name, { logsRetention: true }),
+ ).findings,
+ ).toEqual([]);
+ const unknown = observabilityRetentionFindings(
+ { plan_name: name, traces_retention_days: 7 },
+ live(name, { logsRetention: true }),
+ );
+ expect(unknown.findings).toContainEqual(
+ expect.objectContaining({
+ field: "traces_retention_days",
+ code: "unverified-observability-retention",
+ }),
+ );
+ expect(unknown.capabilities.tracesRetention).toBeUndefined();
+});
+it("falls back per field and refuses stale/future capability claims", () => {
+ const name = "Observability-Monitoring-Medium-EU01";
+ const partial = observabilityPlanCapabilities(
+ name,
+ live(name, { metricsRetention: true }),
+ );
+ expect(partial).toMatchObject({
+ source: "live-and-static",
+ logsRetention: false,
+ });
+ for (const offset of [-16 * 60000, 2 * 60000]) {
+ const catalogue = live(name, { logsRetention: true });
+ catalogue.fetchedAt = new Date(Date.now() + offset).toISOString();
+ expect(observabilityPlanCapabilities(name, catalogue)).toMatchObject({
+ source: "static",
+ logsRetention: false,
+ });
+ }
+});
+it("reports absence in a fresh catalogue and permits nullable unsupported options", () => {
+ const result = observabilityRetentionFindings({
+ plan_name: "Observability-Frontend-Starter-EU01",
+ logs_retention_days: null,
+ metrics_retention_days: null,
+ });
+ expect(result.findings).toEqual([]);
+ expect(result.capabilities.metricsRetention).toBe(false);
+ expect(
+ observabilityRetentionFindings(
+ { plan_name: "missing" },
+ live("present", {}),
+ ).findings[0]?.code,
+ ).toBe("observability-plan-unavailable");
+});
+it.each([0, -1, 1.5, 31])(
+ "rejects out-of-contract logs retention %s",
+ (value) => {
+ expect(
+ observabilityRetentionFindings({ logs_retention_days: value }).findings,
+ ).toContainEqual(
+ expect.objectContaining({ code: "invalid-observability-retention" }),
+ );
+ },
+);
+it("keeps explicit valid metrics and signals separate", () => {
+ expect(
+ observabilityRetentionFindings({
+ logs_retention_days: 30,
+ traces_retention_days: 1,
+ metrics_retention_days: 780,
+ }).findings,
+ ).toEqual([]);
+ expect(
+ observabilityRetentionFindings({ metrics_retention_days: 781 }).findings,
+ ).toContainEqual(
+ expect.objectContaining({
+ field: "metrics_retention_days",
+ code: "invalid-observability-retention",
+ }),
+ );
+});
+
+it("does not enable an option rejected by the reviewed native execution contract", () => {
+ const name = "Observability-Monitoring-Medium-EU01";
+ const report = observabilityPlanCapabilities(
+ name,
+ live(name, {
+ metricsRetention: true,
+ logsRetention: true,
+ tracesRetention: true,
+ }),
+ );
+ expect(report).toMatchObject({
+ source: "live-and-static",
+ logsRetention: false,
+ tracesRetention: false,
+ });
+});
+
+it("recognizes the API Metrics-Endpoint plan spelling in the static fallback", () => {
+ const report = observabilityRetentionFindings({
+ plan_name: "Observability-Metrics-Endpoint-100k-EU01",
+ metrics_retention_days: 90,
+ });
+ expect(report.capabilities).toMatchObject({
+ source: "static",
+ metricsRetention: false,
+ });
+ expect(report.findings).toContainEqual(
+ expect.objectContaining({ code: "unsupported-observability-retention" }),
+ );
+});
diff --git a/landing-zone-configurator/app/tests/platform-plan.test.ts b/landing-zone-configurator/app/tests/platform-plan.test.ts
index 405dd191..0f5ecaef 100644
--- a/landing-zone-configurator/app/tests/platform-plan.test.ts
+++ b/landing-zone-configurator/app/tests/platform-plan.test.ts
@@ -173,6 +173,7 @@ describe.skipIf(!enabled)(
applicationContracts = false,
services = false,
firewall = false,
+ platformRoot = false,
) {
let owner = await session();
const organizationId = randomUUID(),
@@ -258,7 +259,12 @@ describe.skipIf(!enabled)(
};
const keyId = randomUUID();
const manifest = preparationManifest(
- { source: "database", configurationId, revision: 1, credentialId },
+ {
+ source: "database",
+ configurationId,
+ revision: 1,
+ credentialId,
+ },
{
document,
head: "1",
@@ -340,7 +346,10 @@ describe.skipIf(!enabled)(
firewallPlansEnabled: firewall,
supportsAccelerator: vi.fn(
(commit: string) =>
- commit === "a256f6896d11134fdc351786f1be5eba4e56b2e2",
+ commit ===
+ (platformRoot
+ ? platformUpgradeAcceleratorCommit
+ : "a256f6896d11134fdc351786f1be5eba4e56b2e2"),
),
supportsArtifact: vi.fn(() => true),
output: vi.fn(
@@ -436,8 +445,11 @@ describe.skipIf(!enabled)(
execution,
token,
);
- async function plan(overrides: object = {}) {
- const run = await plans.start(owner, token, preparationId);
+ async function plan(
+ overrides: object = {},
+ targetPreparationId = preparationId,
+ ) {
+ const run = await plans.start(owner, token, targetPreparationId);
const ticket = tickets.get(run.id)!;
await plans.input(ticket);
await plans.stage(ticket, "validating");
@@ -481,6 +493,79 @@ describe.skipIf(!enabled)(
};
}
+ it("blocks live-incompatible retention before preparing and uses reviewed fallback when catalogue loading fails", async () => {
+ const test = await fixture(false, true);
+ if (test.manifest.configuration.schemaVersion !== 3)
+ throw new Error("Expected common configuration fixture");
+ const document = editCommonInput(
+ test.manifest.configuration,
+ "observability",
+ {
+ plan_name: "Observability-Starter-EU01",
+ logs_retention_days: 7,
+ },
+ );
+ await migration!.query(
+ "UPDATE lzc.configurations SET document=$2 WHERE id=$1",
+ [test.configurationId, JSON.stringify(recordDraft(document))],
+ );
+ const unavailable = { status: "unavailable" as const, options: [] };
+ const automatic = vi.fn(async () => ({
+ region: "eu01",
+ projectId: null,
+ fetchedAt: new Date().toISOString(),
+ gitFlavors: unavailable,
+ vpnPlans: unavailable,
+ kubernetesVersions: unavailable,
+ machineTypes: unavailable,
+ availabilityZones: unavailable,
+ volumeTypes: unavailable,
+ observabilityPlans: {
+ status: "available" as const,
+ options: [
+ {
+ value: "Observability-Starter-EU01",
+ label: "Starter",
+ capabilities: {
+ metricsRetention: true,
+ logsRetention: false,
+ tracesRetention: true,
+ },
+ },
+ ],
+ },
+ }));
+ const preparations = new Preparations(
+ pool,
+ test.repositories,
+ test.profiles,
+ false,
+ undefined,
+ { automatic },
+ );
+ const request = {
+ source: "database",
+ configurationId: test.configurationId,
+ revision: 1,
+ credentialId: test.credentialId,
+ } as const;
+ await expect(
+ preparations.create(test.owner, null, request),
+ ).rejects.toMatchObject({
+ code: "observability_plan_incompatible",
+ });
+ expect(await preparations.list(test.owner)).toHaveLength(1);
+ expect(test.runner.start).not.toHaveBeenCalled();
+ automatic.mockRejectedValueOnce(new Error("catalogue unavailable"));
+ const prepared = await preparations.create(test.owner, null, request);
+ expect(
+ (await preparations.list(test.owner)).find(
+ (item) => item.id === prepared.id,
+ )?.manifest.configuration,
+ ).toEqual(document);
+ expect(test.runner.start).not.toHaveBeenCalled();
+ });
+
it("prepares and dispatches saved initial service inputs without bypassing tenant, ticket or approval gates", async () => {
const test = await fixture(false, true);
const preparations = new Preparations(
@@ -1751,9 +1836,30 @@ describe.skipIf(!enabled)(
).rejects.toBeDefined();
});
- async function failedCheckpoint() {
- const test = await fixture();
- const saved = await test.plan();
+ async function failedCheckpoint(platformRoot = false) {
+ const test = await fixture(false, platformRoot, false, platformRoot);
+ const currentPreparation = platformRoot
+ ? await new Preparations(
+ pool,
+ test.repositories,
+ test.profiles,
+ true,
+ platformUpgradeAcceleratorCommit,
+ ).create(test.owner, null, {
+ source: "database",
+ configurationId: test.configurationId,
+ revision: 1,
+ credentialId: test.credentialId,
+ platformUpgrade: {
+ confirm: true,
+ acceleratorCommit: platformUpgradeAcceleratorCommit,
+ },
+ })
+ : undefined;
+ const saved = await test.plan(
+ {},
+ currentPreparation?.id ?? test.preparationId,
+ );
const run = await test.plans.apply(
test.owner,
test.token,
@@ -1788,7 +1894,21 @@ describe.skipIf(!enabled)(
errorCode: "apply_failed",
});
const checkpoint = await test.plans.checkpoint(test.owner, run.id);
- return { ...test, saved, run, checkpoint };
+ return {
+ ...test,
+ manifest: currentPreparation
+ ? (
+ await new Preparations(
+ pool,
+ test.repositories,
+ test.profiles,
+ ).list(test.owner)
+ ).find((item) => item.id === currentPreparation.id)?.manifest
+ : test.manifest,
+ saved,
+ run,
+ checkpoint,
+ };
}
it.each(["bootstrap", "migration"])(
@@ -2245,6 +2365,78 @@ describe.skipIf(!enabled)(
},
);
+ it("allows a reviewed current-root bootstrap correction only for the exact reconciled checkpoint without changing state", async () => {
+ const test = await failedCheckpoint(true);
+ const preparations = new Preparations(
+ pool,
+ test.repositories,
+ test.profiles,
+ true,
+ platformUpgradeAcceleratorCommit,
+ );
+ const request = {
+ source: "database" as const,
+ configurationId: test.configurationId,
+ revision: 1,
+ credentialId: test.credentialId,
+ platformUpgrade: {
+ confirm: true as const,
+ acceleratorCommit: platformUpgradeAcceleratorCommit,
+ },
+ } as const;
+ await expect(
+ preparations.create(test.owner, null, request),
+ ).rejects.toMatchObject({ code: "platform_upgrade_state_unavailable" });
+ await test.plans.reconcile(test.owner, test.run.id, {
+ confirmRetainState: true,
+ stateVersion: test.checkpoint.stateVersion,
+ checkpointSha256: test.checkpoint.checkpointSha256,
+ });
+ const key = stableStateKey(test.owner, test.manifest);
+ const before = (
+ await migration!.query(
+ "SELECT version,ciphertext,backend_id,lock_run_id FROM lzc.platform_states WHERE state_key=$1",
+ [key],
+ )
+ ).rows;
+ const starts = test.runner.start.mock.calls.length;
+ const prepared = await preparations.create(test.owner, null, request);
+ expect(
+ (await preparations.list(test.owner)).find(
+ (item) => item.id === prepared.id,
+ )?.manifest.accelerator.commit,
+ ).toBe(platformUpgradeAcceleratorCommit);
+ expect(
+ (
+ await migration!.query(
+ "SELECT version,ciphertext,backend_id,lock_run_id FROM lzc.platform_states WHERE state_key=$1",
+ [key],
+ )
+ ).rows,
+ ).toEqual(before);
+ expect(test.runner.start).toHaveBeenCalledTimes(starts);
+ const fresh = await test.plans.start(test.owner, test.token, prepared.id);
+ expect(
+ (
+ await migration!.query(
+ "SELECT state_key,state_version FROM lzc.plan_runs WHERE id=$1",
+ [fresh.id],
+ )
+ ).rows[0],
+ ).toMatchObject({
+ state_key: key,
+ state_version: test.checkpoint.stateVersion,
+ });
+ await test.plans.cancel(test.owner, fresh.id);
+ await migration!.query(
+ "UPDATE lzc.platform_states SET version=version+1 WHERE state_key=$1",
+ [key],
+ );
+ await expect(
+ preparations.create(test.owner, null, request),
+ ).rejects.toMatchObject({ code: "platform_upgrade_state_unavailable" });
+ });
+
it("reconciles only explicitly reviewed checkpoints once and preserves state for a corrected fresh plan", async () => {
const test = await failedCheckpoint();
expect(test.checkpoint.canResume).toBe(true);
diff --git a/landing-zone-configurator/deploy/runner/package.sh b/landing-zone-configurator/deploy/runner/package.sh
index 6cebb163..8b6b1407 100644
--- a/landing-zone-configurator/deploy/runner/package.sh
+++ b/landing-zone-configurator/deploy/runner/package.sh
@@ -40,7 +40,7 @@ cp "$tofu_bin" "$runner_dir/tools/tofu"
cp ../deploy/runner/run-plan.sh ../deploy/runner/runner.tfrc "$runner_dir/"
platform_commit=a256f6896d11134fdc351786f1be5eba4e56b2e2
if [[ "${LZC_PACKAGE_PLATFORM_UPGRADE_ROOT:-false}" == "true" ]]; then
- platform_commit=c4b43c36af198985980b17626c48d357795e3fbd
+ platform_commit=9e7fb46c329aca32e878ce1f0ea3b944ea240354
else
git fetch --no-tags https://github.com/stackitcloud/stackit-landing-zone.git "$platform_commit"
fi
diff --git a/landing-zone-configurator/docs/accelerator-inputs.json b/landing-zone-configurator/docs/accelerator-inputs.json
index 5118be0a..48556697 100644
--- a/landing-zone-configurator/docs/accelerator-inputs.json
+++ b/landing-zone-configurator/docs/accelerator-inputs.json
@@ -1,10 +1,22 @@
{
"schemaVersion": 1,
- "sourceSha256": "a7bdc9a31e93d355e228072c743b5d85a1dae956d3676cd9079ab904e8ee6f23",
+ "sourceSha256": "c650b337ee9e154b988927c9a129091b6c6627ff90e9d1661bb9c8ba7815bda5",
"variables": [
+ {
+ "name": "bucket_naming",
+ "line": 1,
+ "description": "Object Storage bucket naming scheme: legacy preserves existing names; project-id includes the complete owning project UUID for STACKIT-wide uniqueness. Changing this for existing buckets requires a reviewed migration.",
+ "type": "string",
+ "required": false,
+ "sensitive": false,
+ "default": "project-id",
+ "validations": [
+ "validation {\n condition = contains([\"legacy\", \"project-id\"], var.bucket_naming)\n error_message = \"Bucket naming must be legacy or project-id.\"\n }"
+ ]
+ },
{
"name": "owner_email",
- "line": 5,
+ "line": 16,
"description": "Email address of the owner. Required for STACKIT resource manager.",
"type": "string",
"required": true,
@@ -12,7 +24,7 @@
},
{
"name": "company_name",
- "line": 10,
+ "line": 21,
"description": "Name of the company.",
"type": "string",
"required": true,
@@ -20,7 +32,7 @@
},
{
"name": "company_code",
- "line": 15,
+ "line": 26,
"description": "Company code used in resource naming conventions.",
"type": "string",
"required": true,
@@ -28,7 +40,7 @@
},
{
"name": "organization_id",
- "line": 20,
+ "line": 31,
"description": "Container ID of the root organization.",
"type": "string",
"required": true,
@@ -36,7 +48,7 @@
},
{
"name": "rm_folder_parent_id",
- "line": 25,
+ "line": 36,
"description": "ID of the parent folder under which the resource manager folders will be created. If not provided, the resource manager folders will be created under the organization.",
"type": "string",
"required": false,
@@ -45,7 +57,7 @@
},
{
"name": "region",
- "line": 31,
+ "line": 42,
"description": "STACKIT region for regional resources.",
"type": "string",
"required": false,
@@ -54,7 +66,7 @@
},
{
"name": "platform_kubernetes_kube_config_override",
- "line": 37,
+ "line": 48,
"description": "Optional raw kubeconfig used by kubernetes/helm platform providers when no platform_kubernetes module output is available.",
"type": "string",
"required": false,
@@ -62,7 +74,7 @@
},
{
"name": "platform_contract_namespace",
- "line": 44,
+ "line": 55,
"description": "Optional stable UUID namespace for Application handoff; defaults to the organization ID for independent CLI use. This is metadata, not an authorization boundary.",
"type": "string",
"required": false,
@@ -74,7 +86,7 @@
},
{
"name": "labels",
- "line": 55,
+ "line": 66,
"description": "Additional labels to apply to all resources.",
"type": [
"map",
@@ -86,7 +98,7 @@
},
{
"name": "organization_owners",
- "line": 61,
+ "line": 72,
"description": "List of organization owners.",
"type": [
"list",
@@ -98,7 +110,7 @@
},
{
"name": "organization_auditors",
- "line": 67,
+ "line": 78,
"description": "List of organization auditors.",
"type": [
"list",
@@ -110,7 +122,7 @@
},
{
"name": "devops",
- "line": 73,
+ "line": 84,
"description": "DevOps module configuration. Set to null to skip deployment.",
"type": [
"object",
@@ -140,7 +152,7 @@
},
{
"name": "platform_kubernetes",
- "line": 82,
+ "line": 93,
"description": "Map of central, region-scoped platform Kubernetes deployments. Empty map skips deployment.",
"type": [
"map",
@@ -504,8 +516,8 @@
},
{
"name": "observability",
- "line": 184,
- "description": "Observability instance configuration for the management module. Set to null to skip observability deployment.",
+ "line": 195,
+ "description": "Observability instance configuration for the management module. Omitted or null retention uses the service plan defaults. Monitoring plans require both retention fields to be omitted or null. Set to null to skip observability deployment.",
"type": [
"object",
{
@@ -536,18 +548,19 @@
"nestedDefaults": {
"values": {
"acl": [],
- "logs_retention_days": 30,
- "metrics_retention_days": 90,
- "metrics_retention_days_1h_downsampling": 90,
- "metrics_retention_days_5m_downsampling": 90,
- "plan_name": "Observability-Starter-EU01",
- "traces_retention_days": 30
+ "plan_name": "Observability-Starter-EU01"
}
- }
+ },
+ "validations": [
+ "validation {\n condition = var.observability == null ? true : (\n !startswith(var.observability.plan_name, \"Observability-Monitoring-\") ||\n (var.observability.logs_retention_days == null \u0026\u0026 var.observability.traces_retention_days == null)\n )\n error_message = \"Monitoring plans do not support logs or traces retention. Omit logs_retention_days and traces_retention_days or set them to null.\"\n }",
+ "validation {\n condition = var.observability == null ? true : (\n !can(regex(\"^Observability-(Frontend|Metrics-?Endpoint)\", var.observability.plan_name)) ||\n alltrue([for value in [var.observability.logs_retention_days, var.observability.traces_retention_days, var.observability.metrics_retention_days, var.observability.metrics_retention_days_5m_downsampling, var.observability.metrics_retention_days_1h_downsampling] : value == null])\n )\n error_message = \"Frontend and MetricsEndpoint plans do not support retention overrides. Omit all retention fields or set them to null.\"\n }",
+ "validation {\n condition = var.observability == null ? true : alltrue([\n for value in [var.observability.logs_retention_days, var.observability.traces_retention_days] : value == null ? true : value \u003e= 1 \u0026\u0026 value \u003c= 30 \u0026\u0026 floor(value) == value\n ])\n error_message = \"Logs and traces retention must be omitted, null or a whole number from 1 to 30 days.\"\n }",
+ "validation {\n condition = var.observability == null ? true : alltrue([\n for value in [var.observability.metrics_retention_days, var.observability.metrics_retention_days_5m_downsampling, var.observability.metrics_retention_days_1h_downsampling] : value == null ? true : value \u003e= 1 \u0026\u0026 value \u003c= 780 \u0026\u0026 floor(value) == value\n ])\n error_message = \"Metrics retention must be omitted, null or a whole number from 1 to 780 days.\"\n }"
+ ]
},
{
"name": "audit_logs",
- "line": 198,
+ "line": 239,
"description": "Audit log routing for the management module. A Telemetry Link streams audit events into a Telemetry Router, which forwards them to a Logs instance and archives them to object storage. link_scopes defaults to a single organization-wide link. retention_days applies to both the Logs instance and, when s3_object_lock is enabled, the archive bucket's default retention. s3_object_lock is off by default and turns on GOVERNANCE-mode WORM protection for the archive bucket, which is not cleanly reversible. Set to null to skip audit logs deployment.",
"type": [
"object",
@@ -592,7 +605,7 @@
},
{
"name": "federated_identity_providers",
- "line": 212,
+ "line": 253,
"description": "List of federated identity providers to configure for the management service account.",
"type": [
"list",
@@ -621,7 +634,7 @@
},
{
"name": "rm_folders",
- "line": 226,
+ "line": 267,
"description": "Map of resource manager folders to create under the root organization. Folder descriptions are unsupported; omit description or leave it empty.",
"type": [
"map",
@@ -684,7 +697,7 @@
},
{
"name": "connectivity",
- "line": 272,
+ "line": 313,
"description": "Connectivity configuration including DNS zones, network areas, firewalls, and VPN. Use network_areas with descriptive keys that reflect any business, security, tenant, or regional boundary; network_area and firewall remain supported for existing single-area configurations. Use firewalls for per-area appliance settings.",
"type": [
"object",
@@ -1282,7 +1295,7 @@
},
{
"name": "connectivity_regions",
- "line": 425,
+ "line": 466,
"description": "Regional connectivity configuration for the statically supported eu01 and eu02 hubs. Set to null to use the single-region connectivity input.",
"type": [
"map",
@@ -1297,7 +1310,7 @@
},
{
"name": "vpn_pre_shared_keys",
- "line": 436,
+ "line": 477,
"description": "Pre-shared keys per connectivity.vpn.connections key, one per tunnel. Kept out of the connectivity object so the topology stays committable; supply through TF_VAR_vpn_pre_shared_keys or a gitignored tfvars file. Minimum 20 characters.",
"type": [
"map",
@@ -1314,7 +1327,7 @@
},
{
"name": "firewall_config",
- "line": 450,
+ "line": 491,
"description": "Policy pushed to one OPNsense appliance through its API. Requires connectivity.firewall to be deployed and firewall_api_credentials to be set. Set to null to leave the appliance untouched.",
"type": [
"object",
@@ -1600,7 +1613,7 @@
},
{
"name": "firewall_admin_username",
- "line": 538,
+ "line": 579,
"description": "Login used to derive the API key from the appliance. The STACKIT OPNsense image ships with root.",
"type": "string",
"required": false,
@@ -1609,7 +1622,7 @@
},
{
"name": "firewall_admin_password",
- "line": 544,
+ "line": 585,
"description": "Password of firewall_admin_username, used once to derive the API key. Defaults to the password baked into the STACKIT OPNsense image. Override through TF_VAR_firewall_admin_password after rotating it, or set to null and supply firewall_api_credentials instead.",
"type": "string",
"required": false,
@@ -1617,7 +1630,7 @@
},
{
"name": "firewall_bootstrap",
- "line": 551,
+ "line": 592,
"description": "Pass -var firewall_bootstrap=true on the two greenfield applies that create the OPNsense API key. It suppresses the Secrets Manager read, which would otherwise fail at plan time because the secret does not exist yet. Never set it on an established deployment: without the bootstrap cache file it plans the destruction of the policy and the stored key. The steady state needs no variable at all.",
"type": "bool",
"required": false,
@@ -1626,7 +1639,7 @@
},
{
"name": "firewall_api_secret_version",
- "line": 557,
+ "line": 598,
"description": "Write version of the OPNsense API key in the Secrets Manager. The key is only transmitted when this number changes, so bump it by one after a re-bootstrap has produced a fresh key, otherwise the Secrets Manager keeps serving the old one.",
"type": "number",
"required": false,
@@ -1635,7 +1648,7 @@
},
{
"name": "firewall_api_credentials",
- "line": 563,
+ "line": 604,
"description": "OPNsense API key and secret. Bootstrap them once from the appliance login with src/modules/firewall-config/scripts/bootstrap-api-key.sh, then supply through TF_VAR_firewall_api_credentials or a gitignored tfvars file. Kept out of firewall_config so the policy stays committable.",
"type": [
"object",
@@ -1649,7 +1662,7 @@
},
{
"name": "sandboxes",
- "line": 577,
+ "line": 618,
"description": "List of sandboxes to create.",
"type": [
"list",
@@ -1674,7 +1687,7 @@
},
{
"name": "landing_zones",
- "line": 591,
+ "line": 632,
"description": "Map of landing zones to create. Public landing zones can create a local network with network_enabled. Corporate landing zones use network_area_key to select a connectivity.network_areas entry; set region to eu01 or eu02 with connectivity_regions.",
"type": [
"map",
@@ -1790,7 +1803,7 @@
},
{
"name": "landing_zone_namespace_services",
- "line": 645,
+ "line": 686,
"description": "Map of namespace-service configurations per landing zone key. If a key is present, namespace service is enabled for that landing zone.",
"type": [
"map",
diff --git a/landing-zone-configurator/docs/assistant-feature-coverage.json b/landing-zone-configurator/docs/assistant-feature-coverage.json
index f57fe0fc..db79a10a 100644
--- a/landing-zone-configurator/docs/assistant-feature-coverage.json
+++ b/landing-zone-configurator/docs/assistant-feature-coverage.json
@@ -3,12 +3,13 @@
"engineRevision": "a256f6896d11134fdc351786f1be5eba4e56b2e2",
"status": "concept-coverage-not-ai-qualification",
"sourceDigests": {
- "packages/domain/src/features.ts": "6f99918f825b2891db70ba023284a8d1ae529965c56d06445a9108fb0d791138",
- "packages/domain/src/accelerator-inputs.json": "6c7c17d9fe550e4f9e1ee41db4463b6ed4840b63e4e01620b99626c8ff8737de",
+ "packages/domain/src/features.ts": "bf2506a3ba0bff45ce87c010a4a86e119dd07b0b9216dfea88e34e71d17c9ba6",
+ "packages/domain/src/accelerator-inputs.json": "5bc4c00a4be5546e44208ec26cc51a5465b4407fbea07f7e3edb807438bab501",
"packages/domain/src/catalogue.json": "0c9fc73cbfff4eb0ea2e9956165646e409fbff107cbf9ca1eb3b78a25dca2059",
"packages/domain/src/project-templates.ts": "6629d6cf5e557682b181bc9aca99d496d493e9ae9070e875f72ff608f0642459",
"packages/domain/src/template-parameters.ts": "ea2cb1e272f4f51da6bc68ea78895febe128b83f2b3022371a5aeeb666120e0a",
- "packages/domain/src/common-validation.ts": "12b1a51aef9055e0146f41fa30f9ba03de0e6e078f78597cc488da9884f0761f",
+ "packages/domain/src/common-validation.ts": "27b7edb026926aef1b6efb4f8e2c131d43a37afb2abaa78f0d600006a5f4a492",
+ "packages/domain/src/observability-plans.ts": "04b12f2744c453ff44f7b386ba6d6b7052b53f66fc483d46e9d5af0f5f75bbe5",
"packages/domain/src/common-document.ts": "64e00aa276f0186b9d4fa70ae88ec13703766a317f1317cbfd6bab790673cb40",
"packages/domain/src/editor-document.ts": "b807d40f04b7739cab026d43a412ed9252d22cb9bd1034fbad858825308c1345",
"packages/domain/src/application-catalogue.ts": "2e1dfe53840775f5acd6212b783d7823673c71620c868abf919dae7e3a0b798a",
@@ -99,6 +100,13 @@
{
"id": "management",
"inputs": [
+ {
+ "input": "bucket_naming",
+ "scenarios": [
+ "A03",
+ "A16"
+ ]
+ },
{
"input": "observability",
"scenarios": [
@@ -246,6 +254,20 @@
}
],
"fields": [
+ {
+ "path": "bucket_naming",
+ "group": "management",
+ "sensitive": false,
+ "type": "string",
+ "optional": true,
+ "commonEditor": "form",
+ "assistantMode": "analyze-question-propose-validated-diff",
+ "scenarios": [
+ "A03",
+ "A16"
+ ],
+ "qualification": "not-qualified"
+ },
{
"path": "owner_email",
"group": "identity",
diff --git a/landing-zone-configurator/docs/assistant-knowledge/management-state.de.md b/landing-zone-configurator/docs/assistant-knowledge/management-state.de.md
index 3a7d3df7..6035118d 100644
--- a/landing-zone-configurator/docs/assistant-knowledge/management-state.de.md
+++ b/landing-zone-configurator/docs/assistant-knowledge/management-state.de.md
@@ -30,6 +30,15 @@ Backend-Bootstrap/-Konfiguration ist eine getrennte Voraussetzung nativer
Ausfuehrung, keine in exportierte Konfiguration eingebettete
Configurator-Laufzeitabhaengigkeit.
+
+`bucket_naming` verwendet standardmäßig `project-id`: Alle Management- und
+Workload-Buckets enthalten die vollständige ID ihres Projekts und unterschiedliche
+Zwecksuffixe, höchstens 63 Zeichen lang. Der Namensraum gilt STACKIT-weit.
+`legacy` ist eine ausdrückliche Kompatibilitätswahl für vorhandene Bucket-Namen.
+Ein Wechsel bei bestehenden Buckets erfordert eine geprüfte Migration oder
+Ersetzungsentscheidung. Nach einem fehlgeschlagenen Apply ohne Buckets können
+vorhandenes Projekt und State mit den neuen Namen weiterverwendet werden.
+
## Abhaengigkeiten
@@ -68,6 +77,13 @@ Disaster Recovery. Niemals Remote-State als Chat-Aktion lesen, abrufen oder
veraendern. Plan, Apply, Destroy, Recovery und Veroeffentlichung haben eigene
Autorisierungsgates; kein gezielter Terraform-Workaround.
+Eine Quellkorrektur darf einen fehlgeschlagenen Bootstrap-Checkpoint nur nach
+explizitem Abgleich seiner exakten State-Version durch den Eigentümer verwenden,
+mit unterstütztem festgelegtem Quellstand und ohne Sperre, Migration, separaten
+Recovery-State oder aktiven Lauf. Eine neue Vorbereitung und einen neu geprüften
+Plan verwenden; niemals mit leerem State beginnen oder den verbrauchten Plan
+wiederholen.
+
## Zugangsdaten
diff --git a/landing-zone-configurator/docs/assistant-knowledge/management-state.md b/landing-zone-configurator/docs/assistant-knowledge/management-state.md
index f0be8757..f4297345 100644
--- a/landing-zone-configurator/docs/assistant-knowledge/management-state.md
+++ b/landing-zone-configurator/docs/assistant-knowledge/management-state.md
@@ -2,55 +2,52 @@
## Purpose
-Provide the platform's management project, Terraform state storage and base
-operating identities. Distinguish these from optional monitoring services and
-from the backend that stores the current Accelerator deployment's own state.
+Management project, state storage and operating identities; distinguish optional
+monitoring and the backend of the current Accelerator deployment.
## Accelerator Contract
-The root calls module.management unconditionally beneath the governance
-platform folder. Ownership, naming, organization and labels are derived from
-root inputs. Management implementation determines state-bucket and identity
-resources; it has no independent invented management_enabled switch.
-The module also creates its Secrets Manager foundation; do not equate that
-instance with every workload's separate secretsmanager_enabled choice. Backend
-bootstrap/configuration is a separate native execution prerequisite, not a
-runtime Configurator dependency embedded into exported configuration.
+module.management always exists under the governance platform folder; no
+management_enabled switch. Root inputs derive ownership, naming and labels.
+Secrets Manager is a foundation, independent of workload secretsmanager_enabled.
+Backend bootstrap/configuration is a separate execution prerequisite.
+
+bucket_naming defaults to project-id: all management/workload bucket names contain
+the full owning project UUID and distinct purpose suffixes within 63 characters.
+STACKIT names are global. Explicit legacy preserves existing bucket names; never
+switch existing buckets without reviewing replacement/migration. A failed Apply
+with no buckets can keep its original project/state and use project-id naming.
## Dependencies
-Governance/naming and credential foundations. Observability, audit routing and
-federation are optional settings attached to management. Their knowledge
-dependencies do not make those services required.
+Governance, naming and credentials. Monitoring, audit and federation stay optional.
## Dialogue
-Explain that "only SNA first" scopes the desired configuration change, not a
-targeted cloud operation: a full native apply still includes mandatory base
-resources and other enabled inputs. Ask about backend ownership, lifecycle,
-retention and operating responsibility without requesting state or passwords.
+“Only SNA first” scopes the draft change, not a targeted cloud operation. Full
+native Apply includes management and other enabled inputs. Discuss ownership,
+lifecycle and recovery without requesting state or credentials.
## Examples
-Synthetic baseline: observability = null, audit_logs = null,
-federated_identity_providers = []. Optional services are disabled but management
-and governance remain part of the root. This is a fragment, not a complete run.
+observability=null, audit_logs=null, federated_identity_providers=[] disables
+optional services, not management/governance. This is not a complete run.
## Limits
-A created state bucket does not prove a configured backend, successful state
-migration, encryption, lock safety or disaster recovery. Never read/pull/mutate
-remote state as a chat action. Plan, apply, destroy, recovery and publication
-have independent authorization gates; no targeted Terraform workaround.
+A bucket proves no backend setup, migration, encryption, locking or recovery.
+Never pull/mutate state as a chat action. Plan, Apply, Destroy, recovery and
+publication require separate authorization. No targeted Terraform workaround.
+A source correction may reuse a failed Bootstrap checkpoint only after explicit
+owner reconciliation of its exact state version, with supported pinned provenance
+and no lock, migration, separate recovery or active run. Use a new preparation
+and reviewed Plan; never restart with empty state or retry the consumed Plan.
## Credentials
-Provide backend/object-storage and provider credentials through approved
-external execution bindings. Keys, passphrases, state contents and plan files
-must never enter model context or a knowledge file.
+Use approved external bindings. No keys, passphrases, state or plans in chat.
## Sources
-Root and management implementation plus deployment-credential documentation
-are fingerprinted in the manifest. Re-review resource/bootstrap changes before
-regeneration; no source snapshot proves operational recovery qualification.
\ No newline at end of file
+Fingerprint root/management and credential docs. Re-review before regeneration;
+source snapshots do not qualify operational recovery.
diff --git a/landing-zone-configurator/docs/assistant-knowledge/manifest.json b/landing-zone-configurator/docs/assistant-knowledge/manifest.json
index 665f594c..500175a1 100644
--- a/landing-zone-configurator/docs/assistant-knowledge/manifest.json
+++ b/landing-zone-configurator/docs/assistant-knowledge/manifest.json
@@ -25,7 +25,10 @@
"externalSources": [
"https://docs.stackit.cloud/platform/access-and-identity/service-accounts/how-tos/manage-service-account-keys/"
],
- "scenarios": ["A16", "A23"]
+ "scenarios": [
+ "A16",
+ "A23"
+ ]
},
{
"id": "stackit-network-components",
@@ -33,10 +36,18 @@
"version": 3,
"checkedOn": "2026-10-12",
"qualification": "local-draft-not-reviewed-release",
- "groups": ["network"],
+ "groups": [
+ "network"
+ ],
"mandatory": false,
- "inputs": ["connectivity", "connectivity_regions"],
- "dependencies": ["identity-foundations", "governance-folders"],
+ "inputs": [
+ "connectivity",
+ "connectivity_regions"
+ ],
+ "dependencies": [
+ "identity-foundations",
+ "governance-folders"
+ ],
"sources": [
"src/modules/connectivity/variables.tf",
"src/modules/connectivity/1-network-area.tf",
@@ -46,7 +57,12 @@
"externalSources": [
"https://registry.terraform.io/providers/stackitcloud/stackit/latest/docs/resources/network_area"
],
- "scenarios": ["A04", "A05", "A15", "A24"]
+ "scenarios": [
+ "A04",
+ "A05",
+ "A15",
+ "A24"
+ ]
},
{
"id": "identity-foundations",
@@ -54,7 +70,9 @@
"version": 3,
"checkedOn": "2026-10-12",
"qualification": "local-draft-not-reviewed-release",
- "groups": ["identity"],
+ "groups": [
+ "identity"
+ ],
"mandatory": false,
"inputs": [
"organization_id",
@@ -65,10 +83,20 @@
"labels",
"platform_contract_namespace"
],
- "dependencies": ["credential-foundations"],
- "sources": ["src/variables.tf", "src/providers.tf", "src/main.tf"],
+ "dependencies": [
+ "credential-foundations"
+ ],
+ "sources": [
+ "src/variables.tf",
+ "src/providers.tf",
+ "src/main.tf"
+ ],
"externalSources": [],
- "scenarios": ["A01", "A21", "A23"]
+ "scenarios": [
+ "A01",
+ "A21",
+ "A23"
+ ]
},
{
"id": "governance-folders",
@@ -76,7 +104,9 @@
"version": 3,
"checkedOn": "2026-10-12",
"qualification": "local-draft-not-reviewed-release",
- "groups": ["governance"],
+ "groups": [
+ "governance"
+ ],
"mandatory": false,
"inputs": [
"rm_folder_parent_id",
@@ -84,7 +114,9 @@
"organization_owners",
"organization_auditors"
],
- "dependencies": ["identity-foundations"],
+ "dependencies": [
+ "identity-foundations"
+ ],
"sources": [
"src/modules/governance/variables.tf",
"src/modules/governance/1-rm-folders.tf",
@@ -93,18 +125,27 @@
"landing-zone-configurator/app/packages/domain/src/common-validation.ts"
],
"externalSources": [],
- "scenarios": ["A02", "A23"]
+ "scenarios": [
+ "A02",
+ "A23"
+ ]
},
{
"id": "management-state",
"file": "management-state.md",
- "version": 1,
- "checkedOn": "2026-10-10",
+ "version": 2,
+ "checkedOn": "2026-10-21",
"qualification": "local-draft-not-reviewed-release",
- "groups": ["management"],
+ "groups": [
+ "management"
+ ],
"mandatory": false,
- "inputs": [],
- "dependencies": ["governance-folders"],
+ "inputs": [
+ "bucket_naming"
+ ],
+ "dependencies": [
+ "governance-folders"
+ ],
"sources": [
"src/main.tf",
"src/modules/management/variables.tf",
@@ -113,30 +154,54 @@
"src/modules/management/3-object-storage.tf",
"src/modules/management/4-service-account.tf",
"landing-zone-configurator/docs/common-feature-model.md",
- "landing-zone-configurator/docs/deployment-credentials.md"
+ "landing-zone-configurator/docs/deployment-credentials.md",
+ "landing-zone-configurator/app/apps/api/src/deployments/preparations.ts",
+ "landing-zone-configurator/app/packages/domain/src/initial-plan.ts"
],
"externalSources": [],
- "scenarios": ["A03", "A16", "A23"]
+ "scenarios": [
+ "A03",
+ "A16",
+ "A23"
+ ]
},
{
"id": "observability",
"file": "observability.md",
- "version": 1,
- "checkedOn": "2026-10-10",
+ "version": 2,
+ "checkedOn": "2026-10-21",
"qualification": "local-draft-not-reviewed-release",
- "groups": ["management"],
+ "groups": [
+ "management"
+ ],
"mandatory": false,
- "inputs": ["observability"],
- "dependencies": ["management-state"],
+ "inputs": [
+ "observability"
+ ],
+ "dependencies": [
+ "management-state"
+ ],
"sources": [
"src/variables.tf",
"src/modules/management/variables.tf",
"src/modules/management/5-observability.tf",
+ "landing-zone-configurator/app/packages/domain/src/observability-plans.ts",
+ "landing-zone-configurator/app/apps/api/src/credentials/catalogues.ts",
"src/modules/landing-zone/variables.tf",
- "src/modules/platform-kubernetes/variables.tf"
+ "src/modules/platform-kubernetes/variables.tf",
+ "landing-zone-configurator/app/apps/api/src/assistant/service.ts",
+ "landing-zone-configurator/app/apps/api/src/assistant/model-serving.ts"
],
- "externalSources": [],
- "scenarios": ["A03", "A09", "A10", "A24"]
+ "externalSources": [
+ "https://docs.stackit.cloud/products/logging-and-monitoring/observability/reference/service-plans-observability/",
+ "https://github.com/stackitcloud/stackit-sdk-go/blob/main/services/observability/v1api/model_plan.go"
+ ],
+ "scenarios": [
+ "A03",
+ "A09",
+ "A10",
+ "A24"
+ ]
},
{
"id": "audit-logs",
@@ -144,10 +209,16 @@
"version": 1,
"checkedOn": "2026-10-10",
"qualification": "local-draft-not-reviewed-release",
- "groups": ["management"],
+ "groups": [
+ "management"
+ ],
"mandatory": false,
- "inputs": ["audit_logs"],
- "dependencies": ["management-state"],
+ "inputs": [
+ "audit_logs"
+ ],
+ "dependencies": [
+ "management-state"
+ ],
"sources": [
"src/variables.tf",
"src/main.tf",
@@ -155,7 +226,12 @@
"src/modules/management/6-audit-logs.tf"
],
"externalSources": [],
- "scenarios": ["A03", "A16", "A23", "A24"]
+ "scenarios": [
+ "A03",
+ "A16",
+ "A23",
+ "A24"
+ ]
},
{
"id": "federated-identities",
@@ -163,10 +239,16 @@
"version": 1,
"checkedOn": "2026-10-10",
"qualification": "local-draft-not-reviewed-release",
- "groups": ["management"],
+ "groups": [
+ "management"
+ ],
"mandatory": false,
- "inputs": ["federated_identity_providers"],
- "dependencies": ["management-state"],
+ "inputs": [
+ "federated_identity_providers"
+ ],
+ "dependencies": [
+ "management-state"
+ ],
"sources": [
"src/variables.tf",
"src/main.tf",
@@ -174,7 +256,11 @@
"src/modules/management/4-service-account.tf"
],
"externalSources": [],
- "scenarios": ["A03", "A16", "A23"]
+ "scenarios": [
+ "A03",
+ "A16",
+ "A23"
+ ]
},
{
"id": "dns-zones",
@@ -182,10 +268,17 @@
"version": 6,
"checkedOn": "2026-10-16",
"qualification": "local-draft-not-reviewed-release",
- "groups": ["network"],
+ "groups": [
+ "network"
+ ],
"mandatory": false,
- "inputs": ["connectivity", "connectivity_regions"],
- "dependencies": ["stackit-network-components"],
+ "inputs": [
+ "connectivity",
+ "connectivity_regions"
+ ],
+ "dependencies": [
+ "stackit-network-components"
+ ],
"sources": [
"src/modules/connectivity/variables.tf",
"src/modules/connectivity/6-dns-zones.tf",
@@ -198,7 +291,14 @@
"https://docs.stackit.cloud/products/network/core-networking/dns/how-tos/manage-dns-zones/",
"https://raw.githubusercontent.com/stackitcloud/terraform-provider-stackit/v0.114.0/stackit/internal/services/dns/zone/resource.go"
],
- "scenarios": ["A04", "A05", "A09", "A12", "A15", "A24"]
+ "scenarios": [
+ "A04",
+ "A05",
+ "A09",
+ "A12",
+ "A15",
+ "A24"
+ ]
},
{
"id": "firewall-infrastructure",
@@ -206,10 +306,18 @@
"version": 5,
"checkedOn": "2026-10-13",
"qualification": "local-draft-not-reviewed-release",
- "groups": ["network", "firewall"],
+ "groups": [
+ "network",
+ "firewall"
+ ],
"mandatory": false,
- "inputs": ["connectivity", "connectivity_regions"],
- "dependencies": ["stackit-network-components"],
+ "inputs": [
+ "connectivity",
+ "connectivity_regions"
+ ],
+ "dependencies": [
+ "stackit-network-components"
+ ],
"sources": [
"src/modules/connectivity/variables.tf",
"src/modules/connectivity/5-firewall.tf",
@@ -220,7 +328,12 @@
"src/main.tf"
],
"externalSources": [],
- "scenarios": ["A04", "A06", "A15", "A24"]
+ "scenarios": [
+ "A04",
+ "A06",
+ "A15",
+ "A24"
+ ]
},
{
"id": "vpn",
@@ -228,10 +341,18 @@
"version": 1,
"checkedOn": "2026-10-10",
"qualification": "local-draft-not-reviewed-release",
- "groups": ["network"],
+ "groups": [
+ "network"
+ ],
"mandatory": false,
- "inputs": ["connectivity", "connectivity_regions", "vpn_pre_shared_keys"],
- "dependencies": ["stackit-network-components"],
+ "inputs": [
+ "connectivity",
+ "connectivity_regions",
+ "vpn_pre_shared_keys"
+ ],
+ "dependencies": [
+ "stackit-network-components"
+ ],
"sources": [
"src/variables.tf",
"src/main.tf",
@@ -240,7 +361,11 @@
"landing-zone-configurator/docs/vpn-configuration-scope.md"
],
"externalSources": [],
- "scenarios": ["A07", "A16", "A24"]
+ "scenarios": [
+ "A07",
+ "A16",
+ "A24"
+ ]
},
{
"id": "firewall-policy",
@@ -248,10 +373,17 @@
"version": 1,
"checkedOn": "2026-10-10",
"qualification": "local-draft-not-reviewed-release",
- "groups": ["firewall"],
+ "groups": [
+ "firewall"
+ ],
"mandatory": false,
- "inputs": ["firewall_config"],
- "dependencies": ["firewall-infrastructure", "firewall-access-bootstrap"],
+ "inputs": [
+ "firewall_config"
+ ],
+ "dependencies": [
+ "firewall-infrastructure",
+ "firewall-access-bootstrap"
+ ],
"sources": [
"src/variables.tf",
"src/modules/firewall-config/variables.tf",
@@ -260,7 +392,12 @@
"src/_firewall-bootstrap.tf"
],
"externalSources": [],
- "scenarios": ["A13", "A16", "A23", "A24"]
+ "scenarios": [
+ "A13",
+ "A16",
+ "A23",
+ "A24"
+ ]
},
{
"id": "firewall-access-bootstrap",
@@ -268,7 +405,10 @@
"version": 1,
"checkedOn": "2026-10-10",
"qualification": "local-draft-not-reviewed-release",
- "groups": ["firewall", "credentials"],
+ "groups": [
+ "firewall",
+ "credentials"
+ ],
"mandatory": false,
"inputs": [
"firewall_admin_username",
@@ -277,7 +417,10 @@
"firewall_bootstrap",
"firewall_api_secret_version"
],
- "dependencies": ["firewall-infrastructure", "management-state"],
+ "dependencies": [
+ "firewall-infrastructure",
+ "management-state"
+ ],
"sources": [
"src/variables.tf",
"src/_firewall-bootstrap.tf",
@@ -285,7 +428,11 @@
"landing-zone-configurator/docs/deployment-credentials.md"
],
"externalSources": [],
- "scenarios": ["A13", "A16", "A23"]
+ "scenarios": [
+ "A13",
+ "A16",
+ "A23"
+ ]
},
{
"id": "devops-git",
@@ -293,10 +440,16 @@
"version": 1,
"checkedOn": "2026-10-10",
"qualification": "local-draft-not-reviewed-release",
- "groups": ["platform"],
+ "groups": [
+ "platform"
+ ],
"mandatory": false,
- "inputs": ["devops"],
- "dependencies": ["management-state"],
+ "inputs": [
+ "devops"
+ ],
+ "dependencies": [
+ "management-state"
+ ],
"sources": [
"src/variables.tf",
"src/modules/devops/variables.tf",
@@ -304,7 +457,10 @@
"src/providers.tf"
],
"externalSources": [],
- "scenarios": ["A08", "A24"]
+ "scenarios": [
+ "A08",
+ "A24"
+ ]
},
{
"id": "platform-kubernetes",
@@ -312,13 +468,18 @@
"version": 1,
"checkedOn": "2026-10-10",
"qualification": "local-draft-not-reviewed-release",
- "groups": ["platform"],
+ "groups": [
+ "platform"
+ ],
"mandatory": false,
"inputs": [
"platform_kubernetes",
"platform_kubernetes_kube_config_override"
],
- "dependencies": ["stackit-network-components", "observability"],
+ "dependencies": [
+ "stackit-network-components",
+ "observability"
+ ],
"sources": [
"src/variables.tf",
"src/modules/platform-kubernetes/variables.tf",
@@ -328,7 +489,13 @@
"landing-zone-configurator/app/packages/domain/src/common-validation.ts"
],
"externalSources": [],
- "scenarios": ["A05", "A09", "A15", "A16", "A24"]
+ "scenarios": [
+ "A05",
+ "A09",
+ "A15",
+ "A16",
+ "A24"
+ ]
},
{
"id": "project-templates",
@@ -336,9 +503,13 @@
"version": 1,
"checkedOn": "2026-10-10",
"qualification": "local-draft-not-reviewed-release",
- "groups": ["projects"],
+ "groups": [
+ "projects"
+ ],
"mandatory": false,
- "inputs": ["landing_zones"],
+ "inputs": [
+ "landing_zones"
+ ],
"dependencies": [
"governance-folders",
"stackit-network-components",
@@ -353,7 +524,14 @@
"landing-zone-configurator/app/packages/domain/src/common-validation.ts"
],
"externalSources": [],
- "scenarios": ["A04", "A10", "A14", "A22", "A23", "A24"]
+ "scenarios": [
+ "A04",
+ "A10",
+ "A14",
+ "A22",
+ "A23",
+ "A24"
+ ]
},
{
"id": "sandbox-projects",
@@ -361,10 +539,16 @@
"version": 1,
"checkedOn": "2026-10-10",
"qualification": "local-draft-not-reviewed-release",
- "groups": ["projects"],
+ "groups": [
+ "projects"
+ ],
"mandatory": false,
- "inputs": ["sandboxes"],
- "dependencies": ["governance-folders"],
+ "inputs": [
+ "sandboxes"
+ ],
+ "dependencies": [
+ "governance-folders"
+ ],
"sources": [
"src/variables.tf",
"src/modules/sandboxes/variables.tf",
@@ -372,7 +556,11 @@
"landing-zone-configurator/app/packages/domain/src/common-document.ts"
],
"externalSources": [],
- "scenarios": ["A11", "A14", "A23"]
+ "scenarios": [
+ "A11",
+ "A14",
+ "A23"
+ ]
},
{
"id": "namespace-services",
@@ -380,10 +568,17 @@
"version": 1,
"checkedOn": "2026-10-10",
"qualification": "local-draft-not-reviewed-release",
- "groups": ["projects"],
+ "groups": [
+ "projects"
+ ],
"mandatory": false,
- "inputs": ["landing_zone_namespace_services"],
- "dependencies": ["platform-kubernetes", "project-templates"],
+ "inputs": [
+ "landing_zone_namespace_services"
+ ],
+ "dependencies": [
+ "platform-kubernetes",
+ "project-templates"
+ ],
"sources": [
"src/variables.tf",
"src/_landing-zone-kubernetes.tf",
@@ -392,7 +587,13 @@
"landing-zone-configurator/app/packages/domain/src/common-validation.ts"
],
"externalSources": [],
- "scenarios": ["A12", "A14", "A16", "A23", "A24"]
+ "scenarios": [
+ "A12",
+ "A14",
+ "A16",
+ "A23",
+ "A24"
+ ]
},
{
"id": "configuration-lifecycle",
@@ -403,7 +604,9 @@
"groups": [],
"mandatory": true,
"inputs": [],
- "dependencies": ["credential-foundations"],
+ "dependencies": [
+ "credential-foundations"
+ ],
"sources": [
"landing-zone-configurator/docs/common-feature-model.md",
"landing-zone-configurator/app/packages/domain/src/common-document.ts",
diff --git a/landing-zone-configurator/docs/assistant-knowledge/observability.de.md b/landing-zone-configurator/docs/assistant-knowledge/observability.de.md
index e0008032..0943cbca 100644
--- a/landing-zone-configurator/docs/assistant-knowledge/observability.de.md
+++ b/landing-zone-configurator/docs/assistant-knowledge/observability.de.md
@@ -47,10 +47,20 @@ Unterstuetzung.
## Beispiele
`metrics_retention_days=30`: Diese Wahl und Plan/ACL des Nutzers vorschlagen.
-Andere Aufbewahrungsueberschreibungen auslassen, um native Defaults zu erben;
+Andere Aufbewahrungsueberschreibungen auslassen, um den Servicestandard zu erben;
keine Beispielwerte fuer Logs/Traces kopieren oder bereits beantwortete ACLs
erneut abfragen. Optionale Aufbewahrungswerte sind keine Pflichtentscheidungen.
+Alle zentralen Aufbewahrungsfelder akzeptieren `null` oder Auslassen für den
+Servicestandard. Frische Live-Kapazitäten haben je Signal Vorrang innerhalb des
+geprüften nativen Vertrags; fehlende Daten nutzen dokumentierte statische Regeln.
+Das bestätigt keine aktuelle Verfügbarkeit. Monitoring unterstützt nur Metriken;
+Frontend/MetricsEndpoint erlauben keine Aufbewahrungsüberschreibungen. Unbekannte
+Unterstützung ist keine Freigabe. Ganzzahlige Tagesgrenzen: Logs/Traces 1–30,
+Metriken/Downsampling 1–780. Editor, Vorbereitung und Vorschlagsübernahme verwenden
+dieselbe Prüfung. Gespeicherte Werte und Tarif bleiben bis zur bewussten Korrektur
+erhalten.
+
## Grenzen
diff --git a/landing-zone-configurator/docs/assistant-knowledge/observability.md b/landing-zone-configurator/docs/assistant-knowledge/observability.md
index f84b7c9d..05514401 100644
--- a/landing-zone-configurator/docs/assistant-knowledge/observability.md
+++ b/landing-zone-configurator/docs/assistant-knowledge/observability.md
@@ -2,45 +2,49 @@
## Purpose
-Logs, traces and metrics centrally or per project; scope and retention follow
-operating needs, not template labels.
+Choose signals, scope, retention and dashboard access for operating needs.
## Accelerator Contract
observability=null disables central management monitoring. Project and
-platform_kubernetes observability have separate nested contracts. Central fields:
-plan_name, acl, logs/traces/metrics and downsampling retention periods. A project
-instance does not imply the same central service or authorization.
+platform_kubernetes have separate nested observability contracts. Central fields:
+plan_name, acl and logs/traces/metrics/downsampling retention. Project monitoring
+implies neither central monitoring nor its authorization.
## Dependencies
-Management, credentials, project/cluster, ingestion paths and deliberate ACLs.
-Respect nested scope. Ordinary telemetry does not prove audit logging.
+Management, credentials, project/cluster, ingestion and deliberate ACLs.
+Telemetry does not prove audit logging.
## Dialogue
-Clarify signals/projects, retention needs, access and dashboard operation.
-Separate central/project scope. Reuse live plans/catalogues; a native default
-plan name does not prove availability, quotas, prices or cross-region support.
+Clarify signals/projects, retention and access. Reuse live plan catalogues;
+native defaults prove no availability, quota, price or cross-region support.
## Examples
-metrics_retention_days=30: propose that choice and the user's plan/ACL. Omit other
-retention overrides to inherit native defaults; do not copy sample logs/traces
-values or ask for answered ACLs. Optional retentions are not mandatory decisions.
+For metrics_retention_days=30, propose that value and the user's plan/ACL.
+Omit other retention overrides; do not copy sample values or repeat answered ACLs.
+All central retention fields accept null/omission for service defaults.
+Fresh live capacities override static families per signal; missing data uses the
+reviewed fallback, not an availability claim. Monitoring has metrics only;
+Frontend/MetricsEndpoint have no configurable retention. Unknown support is not
+permission. Whole-day limits: logs/traces 1-30, metrics/downsampling 1-780.
+Never change plans or discard saved values silently. Optional overrides are not
+mandatory decisions. Editor, preparation and proposal acceptance share validation.
## Limits
-Estimates need measured volume and current limits. Empty/default ACLs are not
-automatically private or secure. Demos do not prove production coverage.
-Typed native Editor proposals change only the local draft; execution is separate.
+Estimates need measured volume and current limits. Default ACLs are not
+inherently private. Demos prove no production coverage. Typed Editor proposals
+change only the local draft; execution is separate.
## Credentials
-Separate provisioning from ingestion/dashboard credentials. No Grafana
-passwords, service tokens, OTLP secrets or raw customer logs in chat.
+Separate provisioning from ingestion/dashboard access. No passwords, tokens,
+OTLP secrets or customer logs in chat.
## Sources
-Management/project/platform variables and manifest/engine binding. Refresh after
-review. Live product facts and operational qualification remain separate.
\ No newline at end of file
+Native variables and manifest/engine binding; refresh after review.
+Live product facts and operational qualification remain separate.
diff --git a/landing-zone-configurator/docs/assistant-test-catalogue.json b/landing-zone-configurator/docs/assistant-test-catalogue.json
index 9b964389..97528762 100644
--- a/landing-zone-configurator/docs/assistant-test-catalogue.json
+++ b/landing-zone-configurator/docs/assistant-test-catalogue.json
@@ -2,12 +2,12 @@
"schemaVersion": 1,
"status": "field-inventory-and-smoke-corpus-not-ai-qualification",
"engineRevision": "a256f6896d11134fdc351786f1be5eba4e56b2e2",
- "knowledgeSha256": "0fd2c183ebdf903b2e7d10e50dac5e4b3abd08e9f665fcc15bbab01b95669299",
+ "knowledgeSha256": "436435106841a476ec0c7cf7a948f0f94e9ac99566ebfdb98838980fe45f3738",
"sourceDigests": {
- "scripts/assistant-scenarios.ts": "441273d9af541a14185062728a9f9a7044df0e8a7c51645a53eb970a341867d9",
+ "scripts/assistant-scenarios.ts": "d9d361ddc0da9d928abeedfa85e6da189f3fed25aa581ca7264723ac85ac24a9",
"scripts/assistant-tests.ts": "5e19b1c74da1ffa996f2d76876cc8dc639da698d0b6f9b7e1fc6637863833a8d"
},
- "suiteSha256": "8c60fd19e7e5a6e8903ccea7987f834112c948b4de8cb60487a1694bc64fe2ee",
+ "suiteSha256": "a186d02cfe1f3c0aa0b82d058006dbb1029b2e4b07020e0e934db478354f19b9",
"topics": [
{
"id": "credential-foundations",
@@ -823,8 +823,33 @@
},
{
"id": "management-state",
- "fields": [],
+ "fields": [
+ {
+ "path": "bucket_naming",
+ "group": "management",
+ "type": "string",
+ "optional": true,
+ "proposalPath": "bucket_naming",
+ "responsibility": "user",
+ "mode": "propose-validated-draft"
+ }
+ ],
"cases": [
+ {
+ "id": "editor-project-unique-buckets",
+ "topic": "management-state",
+ "fixture": "baseline",
+ "message": "Bitte Bucket-Namensschema im lokalen Entwurf ausdrücklich auf bucket_naming=project-id setzen, damit die vollständige jeweilige Projekt-ID enthalten ist. Keine sonstigen Änderungen, kein Plan oder Apply.",
+ "editorExpected": {
+ "path": "bucket_naming",
+ "value": "project-id"
+ },
+ "assertions": [
+ "valid_dialogue",
+ "reviewed_topic_reference",
+ "no_changes"
+ ]
+ },
{
"id": "management-state-advice",
"topic": "management-state",
@@ -939,6 +964,21 @@
"no_changes"
]
},
+ {
+ "id": "editor-monitoring-retention",
+ "topic": "observability",
+ "fixture": "baseline",
+ "message": "Bitte zentrale Observability als lokalen Entwurf einrichten: plan_name Observability-Monitoring-Medium-EU01, ACL 203.0.113.0/24, metrics_retention_days 30. Logs und Traces sind im Monitoring-Tarif nicht unterstützt, dafür keine Retention setzen. Keine Ausführung.",
+ "editorExpected": {
+ "path": "observability.metrics_retention_days",
+ "value": 30
+ },
+ "assertions": [
+ "valid_dialogue",
+ "reviewed_topic_reference",
+ "no_changes"
+ ]
+ },
{
"id": "observability-advice",
"topic": "observability",
diff --git a/landing-zone-configurator/docs/common-editor.de.md b/landing-zone-configurator/docs/common-editor.de.md
index 9d4fef98..8eacc4c1 100644
--- a/landing-zone-configurator/docs/common-editor.de.md
+++ b/landing-zone-configurator/docs/common-editor.de.md
@@ -493,3 +493,31 @@ Pflichtangaben und Tunnel-Einstellungen prüfen. VPN-Ausführung bleibt gesperrt
Der anschließend entstandene separate Application-Root und sein Compiler sind
ein lokaler bzw. im Feature-Branch prüfbarer Prototyp, kein Bestandteil der
aktivierten Self-Service-Oberfläche.
+
+
+## Fähigkeiten von Observability-Tarifen
+
+Der Editor behält Tarifauswahl und alle expliziten Aufbewahrungswerte bei. Frische
+Katalogeinträge tragen ausschließlich validierte Kapazitätsmerkmale für
+Metriken/Logs/Traces, keine rohen API-Antworten. Kapazität null verbietet die
+entsprechende Aufbewahrungsüberschreibung; fehlende Angaben gelten als unbekannt.
+Daten älter als 15 Minuten oder aus der Zukunft gelten nicht als live. Fehlende
+Felder verwenden die geprüfte statische Tarifgruppenregel. Live-Daten dürfen den
+gepinnten nativen Vertrag weiter einschränken, aber keine Einstellungen freigeben,
+die der geprüfte native Runner ausdrücklich zurückweist.
+
+Monitoring unterstützt Metrikaufbewahrung, keine Logs/Traces. Frontend und Metrics
+Endpoint haben keine konfigurierbare Aufbewahrung. Unbekannte Unterstützung wird
+zur Prüfung angezeigt; Vorbereitung weist nicht verifizierte explizite Optionen
+zurück. Alle zentralen Aufbewahrungsfelder akzeptieren Auslassen/null für den
+Servicestandard. Ganzzahlige Tagesgrenzen entsprechen den dokumentierten
+Servicegrenzen: Logs/Traces 1–30, Metriken/Downsampling 1–780. Dies garantiert weder
+Quoten noch Verfügbarkeit im Zielprojekt.
+
+Bekannt unzulässige optionale Felder lassen sich nicht aktivieren. Vorhandene
+inkompatible Werte bleiben sichtbar und können bewusst zurückgesetzt werden;
+ein Tarifwechsel entfernt sie niemals. Die Live-Prüfung erhält andere Prüfungen,
+einschließlich ACLs. Der Server prüft Fähigkeiten vor Vorbereitung und
+Assistant-Vorschlagsübernahme erneut. Der Assistant erhält dieselben sicheren
+Merkmale und geprüften Fallback-Fakten. Weder Katalogzugriff noch
+Vorschlagsübernahme erlauben Apply.
diff --git a/landing-zone-configurator/docs/common-editor.md b/landing-zone-configurator/docs/common-editor.md
index a1b9fe04..d07491c5 100644
--- a/landing-zone-configurator/docs/common-editor.md
+++ b/landing-zone-configurator/docs/common-editor.md
@@ -481,3 +481,28 @@ required inputs and tunnel settings. VPN execution remains blocked.
The subsequently created separate Application root and its compiler are
a prototype testable locally or on the feature branch, not part of
the activated self-service interface.
+
+
+## Observability plan capabilities
+
+The editor retains the selected plan and all explicit retention values. Fresh
+Observability catalogue entries carry only validated metric/log/trace capacity
+flags, not raw API responses. A zero capacity forbids its retention override;
+missing capacity is unknown. Data older than 15 minutes or from the future is
+not treated as live. Missing fields fall back to the reviewed service-family
+policy. Live data can further restrict the pinned native contract, but cannot
+expand settings that the reviewed native engine explicitly rejects.
+
+Monitoring supports metrics retention, not logs or traces. Frontend and Metrics
+Endpoint have no configurable retention. Unknown support is shown for review;
+preparation rejects unverified explicit options. All central retention fields
+accept omission/null for service defaults. Whole-day bounds use the documented
+service limits: logs/traces 1–30, metrics/downsampling 1–780. This is not a quota
+or target-project availability guarantee.
+
+Known unsupported optional fields cannot be activated. Existing incompatible
+values stay visible and can be deliberately reset; selecting another plan never
+drops them. Live-aware validation preserves unrelated validation, including ACLs.
+The server rechecks capabilities before preparation and Assistant proposal
+acceptance. The Assistant receives the same safe capability flags and reviewed
+fallback facts. Neither catalogue access nor proposal acceptance authorizes Apply.
diff --git a/landing-zone-configurator/docs/deployment-credentials.de.md b/landing-zone-configurator/docs/deployment-credentials.de.md
index f9d81657..aa7a271f 100644
--- a/landing-zone-configurator/docs/deployment-credentials.de.md
+++ b/landing-zone-configurator/docs/deployment-credentials.de.md
@@ -23,6 +23,15 @@ Stand: 2026-09-30. Nächster Baustein nach Fork-Speicherung und tfvars-Export.
## Optionaler Administrationszugang für Firewall-HA
+Verwende den aktuellen Appliance-Login, kein gewünschtes künftiges Passwort. Ein
+frisch gestartetes gepinntes Image behält seinen Image-Zugang, bis ein Betreiber
+ihn ändert; das Speichern des Profils legt weder Benutzer an noch konfiguriert es
+eine VM. Prüfe beide WAN-Login-Seiten im Connectivity-Projekt. Hat ein Apply die
+VMs bereits erstellt, das Profil korrigieren und eine neue Vorbereitung/einen
+neuen Plan mit dem erhaltenen Checkpoint verwenden; weder VMs neu erstellen noch
+den verbrauchten gespeicherten Plan erneut ausführen.
+
+
Aktiviere beim Anlegen des Profils **OPNsense-Administrationszugang für Firewall-HA
hinterlegen** und trage den bestehenden GUI-Administrator samt Passwort für beide
Appliances ein. Einzelne Firewall-Instanzen benötigen diesen zusätzlichen Zugang
diff --git a/landing-zone-configurator/docs/deployment-credentials.md b/landing-zone-configurator/docs/deployment-credentials.md
index 71e9a2f5..2e43746a 100644
--- a/landing-zone-configurator/docs/deployment-credentials.md
+++ b/landing-zone-configurator/docs/deployment-credentials.md
@@ -19,6 +19,14 @@ As of 2026-09-30. Next building block after fork storage and tfvars export.
## Optional Firewall HA administration
+Use the current appliance login, not a desired future password. A freshly booted
+pinned image retains its image account until an operator changes it; storing the
+profile does not create a user or configure either VM. Check both WAN login pages
+in the connectivity project. If an Apply already created the VMs, correct the
+profile and use a new preparation/Plan against the retained checkpoint; do not
+recreate the VMs or reuse the consumed saved Plan.
+
+
For Firewall HA, enable **Store OPNsense administration credentials for Firewall
HA** when creating the profile and enter the existing GUI administrator username
and password for both appliances. Single-node Firewall infrastructure does not
diff --git a/landing-zone-configurator/docs/deployment-preparation.de.md b/landing-zone-configurator/docs/deployment-preparation.de.md
index 59a7e6ce..e003c37a 100644
--- a/landing-zone-configurator/docs/deployment-preparation.de.md
+++ b/landing-zone-configurator/docs/deployment-preparation.de.md
@@ -105,7 +105,7 @@ künftigen Plan/Apply müssen Zugriff, Secret-Version und Ziel erneut geprüft w
Ergänzung vom 2026-10-06: Die gewöhnliche Vorbereitung bleibt auf `a256f68`
gebunden. Für den Contract-Output kann eine zusätzliche Vorbereitung ausdrücklich
-den fest qualifizierten Commit `c4b43c36af198985980b17626c48d357795e3fbd` wählen.
+den fest qualifizierten Commit `9e7fb46c329aca32e878ce1f0ea3b944ea240354` wählen.
Das ist derzeit ein lokaler, opt-in Laufpfad, keine allgemeine Source-Auswahl und
keine Produktionsfreigabe.
@@ -123,16 +123,26 @@ Revision und das eigene Credential-Profil. Die zusätzliche Auswahl lautet:
{
"platformUpgrade": {
"confirm": true,
- "acceleratorCommit": "c4b43c36af198985980b17626c48d357795e3fbd"
+ "acceleratorCommit": "9e7fb46c329aca32e878ce1f0ea3b944ea240354"
}
}
```
-Der Server verlangt ein passendes qualifiziertes Paket sowie einen bestehenden,
-entsperrten S3-State. Fremde Revisionen, zusätzliche Namespace-/Tenant-Felder und
-abweichende Backend-Bindungen werden abgelehnt. Die neue Vorbereitung verwendet
-denselben State und dieselbe Konfiguration. Alte Manifeste, Artefakte, Revisionen
-und Freigaben werden nicht umgeschrieben.
+Der Server verlangt ein passendes qualifiziertes Paket und behält die vorhandene
+State-Bindung bei. Eine initialisierte Plattform benötigt normalerweise einen
+entsperrten S3-State. Nach einem teilweise fehlgeschlagenen Bootstrap-Apply kann
+stattdessen der vorhandene verschlüsselte Checkpoint verwendet werden, wenn der
+Eigentümer ihn über „Checkpoint prüfen“ ausdrücklich geprüft und zur Wiederaufnahme
+freigegeben hat. Der Nachweis muss exakt zur aktuellen State-Version, Konfiguration
+und zum Mandanten passen. Der fehlgeschlagene Apply muss den aktuell festgelegten
+Plattform-Quellstand oder dessen unterstützten Vorgänger
+`c4b43c36af198985980b17626c48d357795e3fbd` verwendet haben.
+Sperren, offene Migrationen, separater Recovery-State und aktive Läufe sperren diesen
+Pfad; ein geänderter Checkpoint benötigt eine erneute Prüfung. Es wird weder ein
+leerer State angelegt noch das Backend migriert. Fremde Revisionen, zusätzliche
+Namespace-/Tenant-Felder und abweichende Backend-Bindungen werden abgelehnt. Die
+neue Vorbereitung verwendet denselben State und dieselbe Konfiguration. Alte
+Manifeste, Artefakte, Revisionen und Freigaben werden nicht umgeschrieben.
Der Contract-Namensraum stammt aus der authentifizierten Serversitzung und ist Teil
des exakten neuen tfvars-Hashes. Die API lockert ihre Tenant-/Organisationsprüfung
diff --git a/landing-zone-configurator/docs/deployment-preparation.md b/landing-zone-configurator/docs/deployment-preparation.md
index 9799a931..6177edcc 100644
--- a/landing-zone-configurator/docs/deployment-preparation.md
+++ b/landing-zone-configurator/docs/deployment-preparation.md
@@ -100,7 +100,7 @@ future Plan/Apply, access, secret version and target must be checked again.
Addition from 2026-10-06: ordinary preparation remains bound to `a256f68`.
For contract output, an additional preparation can explicitly
-select the fixed qualified commit `c4b43c36af198985980b17626c48d357795e3fbd`.
+select the fixed qualified commit `9e7fb46c329aca32e878ce1f0ea3b944ea240354`.
This is currently a local opt-in execution path, not general source selection or
production approval.
@@ -118,16 +118,23 @@ revision and own credential profile. The additional selection is:
{
"platformUpgrade": {
"confirm": true,
- "acceleratorCommit": "c4b43c36af198985980b17626c48d357795e3fbd"
+ "acceleratorCommit": "9e7fb46c329aca32e878ce1f0ea3b944ea240354"
}
}
```
-The server requires a matching qualified package and an existing,
-unlocked S3 state. Other revisions, extra namespace/tenant fields and
-different backend bindings are rejected. The new preparation uses
-the same state and configuration. Old manifests, artifacts, revisions
-and approvals are not rewritten.
+The server requires a matching qualified package and preserves the existing state
+binding. An initialized platform normally requires an unlocked S3 state. A
+partially failed Bootstrap Apply can instead use its existing encrypted checkpoint
+only after the owner explicitly reviews and reconciles it through “Check checkpoint”.
+The reconciliation receipt must match the exact current state version, configuration
+and tenant. The failed Apply must have used the current pinned platform source or
+its supported predecessor `c4b43c36af198985980b17626c48d357795e3fbd`.
+Locks, pending migrations, separate recovery state and active runs block this path;
+a changed checkpoint requires renewed review. This does not create an empty state
+or migrate the backend. Other revisions, extra namespace/tenant fields and different
+backend bindings are rejected. The new preparation uses the same state and
+configuration. Old manifests, artifacts, revisions and approvals are not rewritten.
The contract namespace comes from the authenticated server session and is part of
the exact new tfvars hash. The API does not relax its tenant/organization check.
diff --git a/landing-zone-configurator/docs/plan-execution.de.md b/landing-zone-configurator/docs/plan-execution.de.md
index da180e19..8899ac8c 100644
--- a/landing-zone-configurator/docs/plan-execution.de.md
+++ b/landing-zone-configurator/docs/plan-execution.de.md
@@ -339,6 +339,45 @@ States bleiben gesperrt und benoetigen einen gesonderten operativen Abgleich.
Es gibt keine automatische Entsperrung, State-Loeschung, Import- oder
Destroy-Aktion. Die Migration muss vor Nutzung der neuen API aktiviert sein.
+### Weltweit eindeutige Bucket-Namen
+
+Object-Storage-Bucket-Namen gelten STACKIT-weit. `bucket_naming = "project-id"`
+ist der Standard für Management- und Workload-Buckets. Namen enthalten die
+vollständige ID ihres Projekts und ein Zwecksuffix (`default`, `tfstate`, bei
+Bedarf `audit-logs`). Nur der lesbare Präfix wird auf insgesamt höchstens 63 Zeichen
+gekürzt.
+
+Vor dem Upgrade einer Installation mit bereits angelegten bisherigen Bucket-Namen
+`bucket_naming = "legacy"` explizit im Root bzw. Kindmodul setzen. Andernfalls plant
+OpenTofu Ersetzungen; diese Änderung migriert weder Bucket-Inhalte noch die
+Backend-Konfiguration. Vorhandenen State beibehalten und den vollständigen Plan
+prüfen. Ein teilweise ausgeführter Bootstrap ohne Bucket-Instanzen kann mit seiner
+bestehenden Projekt-ID den neuen Standard verwenden. Configurator-Ausführung
+benötigt zusätzlich einen geprüften Runner-Pin mit diesem nativen Vertrag; eine
+Quellcodeänderung allein aktualisiert keinen gehosteten Runner.
+Siehe [den erfassten Namensfehler](https://github.com/stackitcloud/stackit-landing-zone/issues/127).
+
+### Mehrere Fehler bei einem teilweise ausgeführten Bootstrap-Apply
+
+Unabhängige Zweige können fehlschlagen, nachdem andere Ressourcen bereits erstellt
+wurden. Konfigurationsidentität und Bootstrap-Checkpoint beibehalten. Vor der
+Freigabe eines neuen Plans den Checkpoint prüfen; weder den verbrauchten Plan
+wiederholen noch eine neue leere Bereitstellung bestätigen. Nach den Korrekturen
+den neuen Plan auf unerwartete Ersetzungen oder Löschungen prüfen und Apply
+separat freigeben.
+
+Ein Monitoring-Serviceplan unterstützt keine Logs-/Trace-Aufbewahrung. Diese
+Felder auslassen oder explizit auf null setzen; Root und Management-Modul erhalten
+null und weisen explizite Monitoring-Werte vor Apply zurück. Andere Tarife nutzen
+bei ausgelassenen Werten ihren Servicestandard; explizite Werte bleiben erhalten.
+
+Ein Object-Storage-Fehler `bucket.name_conflict` belegt keine Zugehörigkeit des
+Buckets zu dieser Bereitstellung. Vor Import oder gezielter Namenskorrektur den
+Checkpoint mit einer autorisierten Abfrage im exakten Management-Projekt
+abgleichen. Dafür nicht `company_code` ändern: Das betrifft viele bestehende
+Ressourcen. Ein sensibler HA-Provisioner kann seine Fehlerausgabe verbergen;
+erstellte VMs belegen weder eine erfolgreiche Anmeldung noch die HA-Konfiguration.
+
### Erfolgreichen Apply mit offener S3-Bestaetigung abschliessen
diff --git a/landing-zone-configurator/docs/plan-execution.md b/landing-zone-configurator/docs/plan-execution.md
index 7a387d02..298d55a7 100644
--- a/landing-zone-configurator/docs/plan-execution.md
+++ b/landing-zone-configurator/docs/plan-execution.md
@@ -126,6 +126,42 @@ Migration `034_platform_reconciliation.sql` adds explicit, audited UI reconcilia
The user can then save the corrected configuration, choose a new preparation and start a new Plan against the same existing state. Apply again requires separate review and approval of the new saved plan. The old plan remains consumed. If the checkpoint has changed meanwhile, a new check is required. Ambiguous Runner aborts, unverifiable migrations and separate recovery states remain blocked and need separate operational reconciliation. No automatic unblocking, state deletion, import or Destroy action. The migration must be enabled before using the new API.
+### Globally unique bucket names
+
+Object Storage bucket names are STACKIT-wide. `bucket_naming = "project-id"` is
+the default for management and workload buckets. Names include the complete owning
+project UUID and a purpose suffix (`default`, `tfstate`, `audit-logs` where used).
+Only the readable prefix is truncated to keep names within 63 characters.
+
+Before upgrading an installation that already owns legacy-named buckets, explicitly
+set `bucket_naming = "legacy"` in the root (or child module). Otherwise OpenTofu
+will plan replacements; this change does not migrate bucket contents or backend
+configuration. Keep existing state and review the full Plan. A partial bootstrap
+with no bucket instances can use the new default with its existing project ID.
+Configurator execution additionally requires a reviewed Runner pin containing
+this native contract; a source change alone does not update a hosted Runner.
+See [the tracked naming defect](https://github.com/stackitcloud/stackit-landing-zone/issues/127).
+
+### Multiple errors during a partial bootstrap Apply
+
+Independent branches can fail after other resources were created. Keep the same
+configuration identity and bootstrap checkpoint. Check the checkpoint before
+allowing replanning; do not repeat the consumed saved plan or confirm a new empty
+deployment. After corrections, inspect the new plan for unexpected replacement
+or deletion before separately approving Apply.
+
+A Monitoring service plan cannot accept logs/traces retention. Omit these fields
+or explicitly set them to null; the root and management module preserve null and
+reject explicit Monitoring overrides before Apply. Other plans use their service
+defaults when these values are omitted; existing explicit retention is preserved.
+
+An Object Storage `bucket.name_conflict` is not proof that a bucket belongs to
+this deployment. Compare the checkpoint with an authorized lookup in the exact
+management project before considering import or a targeted naming correction.
+Do not change `company_code` to resolve it: that affects many existing resources.
+A sensitive HA provisioner can hide its error output; resource creation alone
+proves neither appliance authentication nor completed HA configuration.
+
### Completing a successful Apply with pending S3 confirmation
diff --git a/src/README.de.md b/src/README.de.md
index 9135b8ab..b335dcad 100644
--- a/src/README.de.md
+++ b/src/README.de.md
@@ -76,6 +76,7 @@ maßgeblich ist die [kanonische englische Referenz](README.de.md).
| Name | Description | Type | Default | Required |
| ---- | ----------- | ---- | ------- | :------: |
| [audit\_logs](#input\_audit\_logs) | Audit log routing for the management module. A Telemetry Link streams audit events into a Telemetry Router, which forwards them to a Logs instance and archives them to object storage. link\_scopes defaults to a single organization-wide link. retention\_days applies to both the Logs instance and, when s3\_object\_lock is enabled, the archive bucket's default retention. s3\_object\_lock is off by default and turns on GOVERNANCE-mode WORM protection for the archive bucket, which is not cleanly reversible. Set to null to skip audit logs deployment. | object({
retention_days = optional(number, 180)
acl = optional(list(string), ["0.0.0.0/0"])
s3_object_lock = optional(bool, true)
link_scopes = optional(list(object({
resource_type = string # organization, folder, project
resource_id = string
})), null)
}) | `null` | no |
+| [bucket\_naming](#input\_bucket\_naming) | Object Storage bucket naming scheme: legacy preserves existing names; project-id includes the complete owning project UUID for STACKIT-wide uniqueness. Changing this for existing buckets requires a reviewed migration. | `string` | `"project-id"` | no |
| [company\_code](#input\_company\_code) | Company code used in resource naming conventions. | `string` | n/a | yes |
| [company\_name](#input\_company\_name) | Name of the company. | `string` | n/a | yes |
| [connectivity](#input\_connectivity) | Connectivity configuration including DNS zones, network areas, firewalls, and VPN. Use network\_areas with descriptive keys that reflect any business, security, tenant, or regional boundary; network\_area and firewall remain supported for existing single-area configurations. Use firewalls for per-area appliance settings. | object({
naming_pattern = optional(string, null)
dns_zones = optional(map(object({
dns_name = string
network_area_key = optional(string, "default")
region = optional(string, null)
name = optional(string, null)
contact_email = optional(string, null)
type = optional(string, "primary")
acl = optional(string, null)
description = optional(string, null)
default_ttl = optional(number, 3600)
})), {})
network_area = optional(object({
ranges = list(string)
transfer_network = string
min_prefix_length = optional(number, 24)
max_prefix_length = optional(number, 28)
default_prefix_length = optional(number, 28)
# Unset means the STACKIT resolvers of var.region, see modules/connectivity/1-network-area.tf.
default_nameservers = optional(list(string), null)
}), null)
network_areas = optional(map(object({
name = optional(string, null)
ranges = list(string)
transfer_network = string
min_prefix_length = optional(number, 24)
max_prefix_length = optional(number, 28)
default_prefix_length = optional(number, 28)
default_nameservers = optional(list(string), null)
})), null)
firewall = optional(object({
zone = string
flavor = string
name = string
volume_performance_class = optional(string, "storage_premium_perf4")
volume_size = optional(number, 16)
lan_network_range = string
wan_network_range = string
lan_ip = optional(string, null)
wan_ip = optional(string, null)
# Active/passive CARP pair. Adds a second appliance in backup_zone and a CARP
# virtual IP on the LAN that replaces the primary's LAN IP as the next hop the
# landing zone routes point at, so a node failure never touches the routes.
# See docs/architecture.md#high-availability-optional.
ha = optional(object({
backup_zone = string
backup_name = optional(string, null) # defaults to "-backup"
backup_lan_ip = optional(string, null) # defaults to the 6th address of lan_network_range
backup_wan_ip = optional(string, null) # defaults to the 6th address of wan_network_range
lan_vip = optional(string, null) # defaults to the 7th address of lan_network_range
vhid = optional(number, 1)
}), null)
}), null)
firewalls = optional(map(object({
zone = string
flavor = string
name = string
volume_performance_class = optional(string, "storage_premium_perf4")
volume_size = optional(number, 16)
lan_network_range = string
wan_network_range = string
lan_ip = optional(string, null)
wan_ip = optional(string, null)
ha = optional(object({
backup_zone = string
backup_name = optional(string, null)
backup_lan_ip = optional(string, null)
backup_wan_ip = optional(string, null)
lan_vip = optional(string, null)
vhid = optional(number, 1)
}), null)
})), null)
vpn = optional(object({
display_name = optional(string, null)
plan_id = optional(string, "p100")
routing_type = optional(string, "ROUTE_BASED")
availability_zones = object({
tunnel1 = string
tunnel2 = string
})
connections = optional(map(object({
display_name = optional(string, null)
enabled = optional(bool, true)
local_subnets = optional(list(string), null)
remote_subnets = optional(list(string), null)
static_routes = optional(list(string), null)
tunnel1 = object({
remote_address = string
peering = optional(object({
local_address = string
remote_address = string
}), null)
phase1 = optional(object({
encryption_algorithms = optional(list(string), ["aes256"])
integrity_algorithms = optional(list(string), ["sha2_384"])
dh_groups = optional(list(string), ["ecp384"])
rekey_time = optional(number, null)
}), {})
phase2 = optional(object({
encryption_algorithms = optional(list(string), ["aes256"])
integrity_algorithms = optional(list(string), ["sha2_384"])
dh_groups = optional(list(string), ["ecp384"])
rekey_time = optional(number, null)
dpd_action = optional(string, null)
start_action = optional(string, null)
}), {})
})
tunnel2 = object({
remote_address = string
peering = optional(object({
local_address = string
remote_address = string
}), null)
phase1 = optional(object({
encryption_algorithms = optional(list(string), ["aes256"])
integrity_algorithms = optional(list(string), ["sha2_384"])
dh_groups = optional(list(string), ["ecp384"])
rekey_time = optional(number, null)
}), {})
phase2 = optional(object({
encryption_algorithms = optional(list(string), ["aes256"])
integrity_algorithms = optional(list(string), ["sha2_384"])
dh_groups = optional(list(string), ["ecp384"])
rekey_time = optional(number, null)
dpd_action = optional(string, null)
start_action = optional(string, null)
}), {})
})
})), {})
}), null)
}) | `null` | no |
@@ -91,7 +92,7 @@ maßgeblich ist die [kanonische englische Referenz](README.de.md).
| [labels](#input\_labels) | Additional labels to apply to all resources. | `map(string)` | `{}` | no |
| [landing\_zone\_namespace\_services](#input\_landing\_zone\_namespace\_services) | Map of namespace-service configurations per landing zone key. If a key is present, namespace service is enabled for that landing zone. | map(object({
demo_enabled = optional(bool, false)
demo_metrics_ingestion = optional(object({
enabled = optional(bool, false)
target_urls = optional(list(string), [])
scheme = optional(string, "https")
metrics_path = optional(string, "/")
scrape_interval = optional(string, "70s")
scrape_timeout = optional(string, "30s")
}), {})
namespace = optional(string, null)
dns_subdomain = optional(string, null)
secretsmanager = optional(bool, true)
sample_load = optional(object({
enabled = optional(bool, false)
image = optional(string, "busybox:1.36")
}), {})
secrets_enforcement = optional(object({
enabled = optional(bool, false)
mode = optional(string, "audit")
allow_opaque_secret_types = optional(list(string), [])
break_glass = optional(object({
enabled = optional(bool, true)
ttl_hours = optional(number, 24)
principals = optional(list(string), [])
}), {})
}), {})
kubernetes_access = optional(object({
enabled = optional(bool, true)
service_account_name = optional(string, null)
}), {})
labels = optional(map(string), {})
annotations = optional(map(string), {})
})) | `{}` | no |
| [landing\_zones](#input\_landing\_zones) | Map of landing zones to create. Public landing zones can create a local network with network\_enabled. Corporate landing zones use network\_area\_key to select a connectivity.network\_areas entry; set region to eu01 or eu02 with connectivity\_regions. | map(object({
project_name = string
project_code = string
owner_email = string
# Set to true for corporate landing zones (connected to network area), false for public
corporate = optional(bool, true)
network_area_key = optional(string, "default")
region = optional(string, null)
env = optional(string, "dev")
role_assignments = optional(list(object({
role = string
subject = string
})), [])
network_enabled = optional(bool, false)
network_prefix_length = optional(number, null)
secretsmanager_enabled = optional(bool, true)
custom_roles = optional(list(object({
name = string
description = string
permissions = list(string)
})), [])
observability = optional(object({
enabled = optional(bool, false)
plan_name = optional(string, "Observability-Starter-EU01")
acl = optional(list(string), [])
name = optional(string, null)
}), {})
})) | `{}` | no |
-| [observability](#input\_observability) | Observability instance configuration for the management module. Set to null to skip observability deployment. | object({
plan_name = optional(string, "Observability-Starter-EU01")
acl = optional(list(string), [])
logs_retention_days = optional(number, 30)
traces_retention_days = optional(number, 30)
metrics_retention_days = optional(number, 90)
metrics_retention_days_5m_downsampling = optional(number, 90)
metrics_retention_days_1h_downsampling = optional(number, 90)
}) | `null` | no |
+| [observability](#input\_observability) | Observability instance configuration for the management module. Omitted or null retention uses the service plan defaults. Monitoring plans require both retention fields to be omitted or null. Set to null to skip observability deployment. | object({
plan_name = optional(string, "Observability-Starter-EU01")
acl = optional(list(string), [])
logs_retention_days = optional(number)
traces_retention_days = optional(number)
metrics_retention_days = optional(number)
metrics_retention_days_5m_downsampling = optional(number)
metrics_retention_days_1h_downsampling = optional(number)
}) | `null` | no |
| [organization\_auditors](#input\_organization\_auditors) | List of organization auditors. | `list(string)` | `[]` | no |
| [organization\_id](#input\_organization\_id) | Container ID of the root organization. | `string` | n/a | yes |
| [organization\_owners](#input\_organization\_owners) | List of organization owners. | `list(string)` | `[]` | no |
diff --git a/src/README.md b/src/README.md
index 90ac98db..11634546 100644
--- a/src/README.md
+++ b/src/README.md
@@ -73,6 +73,7 @@ The generated technical reference below documents this root module.
| Name | Description | Type | Default | Required |
| ---- | ----------- | ---- | ------- | :------: |
| [audit\_logs](#input\_audit\_logs) | Audit log routing for the management module. A Telemetry Link streams audit events into a Telemetry Router, which forwards them to a Logs instance and archives them to object storage. link\_scopes defaults to a single organization-wide link. retention\_days applies to both the Logs instance and, when s3\_object\_lock is enabled, the archive bucket's default retention. s3\_object\_lock is off by default and turns on GOVERNANCE-mode WORM protection for the archive bucket, which is not cleanly reversible. Set to null to skip audit logs deployment. | object({
retention_days = optional(number, 180)
acl = optional(list(string), ["0.0.0.0/0"])
s3_object_lock = optional(bool, true)
link_scopes = optional(list(object({
resource_type = string # organization, folder, project
resource_id = string
})), null)
}) | `null` | no |
+| [bucket\_naming](#input\_bucket\_naming) | Object Storage bucket naming scheme: legacy preserves existing names; project-id includes the complete owning project UUID for STACKIT-wide uniqueness. Changing this for existing buckets requires a reviewed migration. | `string` | `"project-id"` | no |
| [company\_code](#input\_company\_code) | Company code used in resource naming conventions. | `string` | n/a | yes |
| [company\_name](#input\_company\_name) | Name of the company. | `string` | n/a | yes |
| [connectivity](#input\_connectivity) | Connectivity configuration including DNS zones, network areas, firewalls, and VPN. Use network\_areas with descriptive keys that reflect any business, security, tenant, or regional boundary; network\_area and firewall remain supported for existing single-area configurations. Use firewalls for per-area appliance settings. | object({
naming_pattern = optional(string, null)
dns_zones = optional(map(object({
dns_name = string
network_area_key = optional(string, "default")
region = optional(string, null)
name = optional(string, null)
contact_email = optional(string, null)
type = optional(string, "primary")
acl = optional(string, null)
description = optional(string, null)
default_ttl = optional(number, 3600)
})), {})
network_area = optional(object({
ranges = list(string)
transfer_network = string
min_prefix_length = optional(number, 24)
max_prefix_length = optional(number, 28)
default_prefix_length = optional(number, 28)
# Unset means the STACKIT resolvers of var.region, see modules/connectivity/1-network-area.tf.
default_nameservers = optional(list(string), null)
}), null)
network_areas = optional(map(object({
name = optional(string, null)
ranges = list(string)
transfer_network = string
min_prefix_length = optional(number, 24)
max_prefix_length = optional(number, 28)
default_prefix_length = optional(number, 28)
default_nameservers = optional(list(string), null)
})), null)
firewall = optional(object({
zone = string
flavor = string
name = string
volume_performance_class = optional(string, "storage_premium_perf4")
volume_size = optional(number, 16)
lan_network_range = string
wan_network_range = string
lan_ip = optional(string, null)
wan_ip = optional(string, null)
# Active/passive CARP pair. Adds a second appliance in backup_zone and a CARP
# virtual IP on the LAN that replaces the primary's LAN IP as the next hop the
# landing zone routes point at, so a node failure never touches the routes.
# See docs/architecture.md#high-availability-optional.
ha = optional(object({
backup_zone = string
backup_name = optional(string, null) # defaults to "-backup"
backup_lan_ip = optional(string, null) # defaults to the 6th address of lan_network_range
backup_wan_ip = optional(string, null) # defaults to the 6th address of wan_network_range
lan_vip = optional(string, null) # defaults to the 7th address of lan_network_range
vhid = optional(number, 1)
}), null)
}), null)
firewalls = optional(map(object({
zone = string
flavor = string
name = string
volume_performance_class = optional(string, "storage_premium_perf4")
volume_size = optional(number, 16)
lan_network_range = string
wan_network_range = string
lan_ip = optional(string, null)
wan_ip = optional(string, null)
ha = optional(object({
backup_zone = string
backup_name = optional(string, null)
backup_lan_ip = optional(string, null)
backup_wan_ip = optional(string, null)
lan_vip = optional(string, null)
vhid = optional(number, 1)
}), null)
})), null)
vpn = optional(object({
display_name = optional(string, null)
plan_id = optional(string, "p100")
routing_type = optional(string, "ROUTE_BASED")
availability_zones = object({
tunnel1 = string
tunnel2 = string
})
connections = optional(map(object({
display_name = optional(string, null)
enabled = optional(bool, true)
local_subnets = optional(list(string), null)
remote_subnets = optional(list(string), null)
static_routes = optional(list(string), null)
tunnel1 = object({
remote_address = string
peering = optional(object({
local_address = string
remote_address = string
}), null)
phase1 = optional(object({
encryption_algorithms = optional(list(string), ["aes256"])
integrity_algorithms = optional(list(string), ["sha2_384"])
dh_groups = optional(list(string), ["ecp384"])
rekey_time = optional(number, null)
}), {})
phase2 = optional(object({
encryption_algorithms = optional(list(string), ["aes256"])
integrity_algorithms = optional(list(string), ["sha2_384"])
dh_groups = optional(list(string), ["ecp384"])
rekey_time = optional(number, null)
dpd_action = optional(string, null)
start_action = optional(string, null)
}), {})
})
tunnel2 = object({
remote_address = string
peering = optional(object({
local_address = string
remote_address = string
}), null)
phase1 = optional(object({
encryption_algorithms = optional(list(string), ["aes256"])
integrity_algorithms = optional(list(string), ["sha2_384"])
dh_groups = optional(list(string), ["ecp384"])
rekey_time = optional(number, null)
}), {})
phase2 = optional(object({
encryption_algorithms = optional(list(string), ["aes256"])
integrity_algorithms = optional(list(string), ["sha2_384"])
dh_groups = optional(list(string), ["ecp384"])
rekey_time = optional(number, null)
dpd_action = optional(string, null)
start_action = optional(string, null)
}), {})
})
})), {})
}), null)
}) | `null` | no |
@@ -88,7 +89,7 @@ The generated technical reference below documents this root module.
| [labels](#input\_labels) | Additional labels to apply to all resources. | `map(string)` | `{}` | no |
| [landing\_zone\_namespace\_services](#input\_landing\_zone\_namespace\_services) | Map of namespace-service configurations per landing zone key. If a key is present, namespace service is enabled for that landing zone. | map(object({
demo_enabled = optional(bool, false)
demo_metrics_ingestion = optional(object({
enabled = optional(bool, false)
target_urls = optional(list(string), [])
scheme = optional(string, "https")
metrics_path = optional(string, "/")
scrape_interval = optional(string, "70s")
scrape_timeout = optional(string, "30s")
}), {})
namespace = optional(string, null)
dns_subdomain = optional(string, null)
secretsmanager = optional(bool, true)
sample_load = optional(object({
enabled = optional(bool, false)
image = optional(string, "busybox:1.36")
}), {})
secrets_enforcement = optional(object({
enabled = optional(bool, false)
mode = optional(string, "audit")
allow_opaque_secret_types = optional(list(string), [])
break_glass = optional(object({
enabled = optional(bool, true)
ttl_hours = optional(number, 24)
principals = optional(list(string), [])
}), {})
}), {})
kubernetes_access = optional(object({
enabled = optional(bool, true)
service_account_name = optional(string, null)
}), {})
labels = optional(map(string), {})
annotations = optional(map(string), {})
})) | `{}` | no |
| [landing\_zones](#input\_landing\_zones) | Map of landing zones to create. Public landing zones can create a local network with network\_enabled. Corporate landing zones use network\_area\_key to select a connectivity.network\_areas entry; set region to eu01 or eu02 with connectivity\_regions. | map(object({
project_name = string
project_code = string
owner_email = string
# Set to true for corporate landing zones (connected to network area), false for public
corporate = optional(bool, true)
network_area_key = optional(string, "default")
region = optional(string, null)
env = optional(string, "dev")
role_assignments = optional(list(object({
role = string
subject = string
})), [])
network_enabled = optional(bool, false)
network_prefix_length = optional(number, null)
secretsmanager_enabled = optional(bool, true)
custom_roles = optional(list(object({
name = string
description = string
permissions = list(string)
})), [])
observability = optional(object({
enabled = optional(bool, false)
plan_name = optional(string, "Observability-Starter-EU01")
acl = optional(list(string), [])
name = optional(string, null)
}), {})
})) | `{}` | no |
-| [observability](#input\_observability) | Observability instance configuration for the management module. Set to null to skip observability deployment. | object({
plan_name = optional(string, "Observability-Starter-EU01")
acl = optional(list(string), [])
logs_retention_days = optional(number, 30)
traces_retention_days = optional(number, 30)
metrics_retention_days = optional(number, 90)
metrics_retention_days_5m_downsampling = optional(number, 90)
metrics_retention_days_1h_downsampling = optional(number, 90)
}) | `null` | no |
+| [observability](#input\_observability) | Observability instance configuration for the management module. Omitted or null retention uses the service plan defaults. Monitoring plans require both retention fields to be omitted or null. Set to null to skip observability deployment. | object({
plan_name = optional(string, "Observability-Starter-EU01")
acl = optional(list(string), [])
logs_retention_days = optional(number)
traces_retention_days = optional(number)
metrics_retention_days = optional(number)
metrics_retention_days_5m_downsampling = optional(number)
metrics_retention_days_1h_downsampling = optional(number)
}) | `null` | no |
| [organization\_auditors](#input\_organization\_auditors) | List of organization auditors. | `list(string)` | `[]` | no |
| [organization\_id](#input\_organization\_id) | Container ID of the root organization. | `string` | n/a | yes |
| [organization\_owners](#input\_organization\_owners) | List of organization owners. | `list(string)` | `[]` | no |
diff --git a/src/application/.terraform.lock.hcl b/src/application/.terraform.lock.hcl
index c65b4c72..e334a297 100644
--- a/src/application/.terraform.lock.hcl
+++ b/src/application/.terraform.lock.hcl
@@ -5,6 +5,7 @@ provider "registry.opentofu.org/hashicorp/time" {
version = "0.14.1"
constraints = ">= 0.14.1, 0.14.1"
hashes = [
+ "h1:Ssb164oIHIO9VWGljof/xqbxbnPmrT5jyJ+WegAj2+k=",
"h1:jfH6FAhiYd3hKB29s8cxk9PUKGdEN0fPB3zQ0IE5pdQ=",
"zh:032ea0f53759a5ade64286ad8a403956bb390860429de3647c6652701c2fff8b",
"zh:204581f170c50a579357b1a067f407b890adfc0404952cb922fefe2aba7655a8",
@@ -29,6 +30,7 @@ provider "registry.opentofu.org/stackitcloud/stackit" {
constraints = ">= 0.114.0, 0.114.0"
hashes = [
"h1:1LWQQnyh7olj5+Ceu33qfZrtvwV6oB4OatOT01QhHBQ=",
+ "h1:Pw89rX8OcLNY06pMMsdZ48ATRHRdc14Hqr7Gz70jfRo=",
"zh:096d6a1d716f124e9a7576318ffb2128ae0ac29e7c1f13b1b3c7723b79f760de",
"zh:0dde99e7b343fa01f8eefc378171fb8621bedb20f59157d6cc8e3d46c738105f",
"zh:1d48af034c791b5565a86c4905abd309152bf50c2c67c44e4943a750a3b0b060",
diff --git a/src/application/README.de.md b/src/application/README.de.md
index 98d60ad6..0c711072 100644
--- a/src/application/README.de.md
+++ b/src/application/README.de.md
@@ -147,3 +147,46 @@ Noch abzunehmen: echter, separat autorisierter zweiphasiger CLI-Plan/Apply,
Backend-Sperrung/-Wiederherstellung, minimal berechtigte Zugangsdaten, ausdrückliche
Migration bestehender States und vollständiger Configurator-Dispatch. Mock-Tests
sind keine Cloud-Abnahme.
+
+
+
+## Requirements
+
+| Name | Version |
+| ---- | ------- |
+| [terraform](#requirement\_terraform) | >= 1.11 |
+| [stackit](#requirement\_stackit) | 0.114.0 |
+| [time](#requirement\_time) | 0.14.1 |
+
+## Providers
+
+| Name | Version |
+| ---- | ------- |
+| [terraform](#provider\_terraform) | n/a |
+
+## Modules
+
+| Name | Source | Version |
+| ---- | ------ | ------- |
+| [application](#module\_application) | ../modules/landing-zone | n/a |
+
+## Resources
+
+| Name | Type |
+| ---- | ---- |
+| [terraform_data.contract](https://registry.terraform.io/providers/hashicorp/terraform/latest/docs/resources/data) | resource |
+
+## Inputs
+
+| Name | Description | Type | Default | Required |
+| ---- | ----------- | ---- | ------- | :------: |
+| [application](#input\_application) | Resolved application instance supplied manually or by the Configurator. Identity and deployment authorization are enforced by the caller's IAM permissions. | object({
configurator_execution = optional(bool, false)
tenant_id = string
instance_id = string
platform_revision = string
template_id = string
template_version = number
name = string
env = optional(string, null)
owner_email = string
target_key = string
network_enabled = optional(bool, false)
network_prefix_length = optional(number, null)
secretsmanager_enabled = bool
custom_roles = optional(list(object({
name = string
description = string
permissions = list(string)
})), [])
role_assignments = optional(list(object({
role = string
subject = string
})), [])
observability = object({
enabled = bool
plan_name = string
acl = list(string)
access_source = optional(string, "explicit-cidrs")
})
}) | n/a | yes |
+| [bucket\_naming](#input\_bucket\_naming) | Object Storage bucket naming scheme: legacy preserves existing names; project-id includes the complete owning project UUID for STACKIT-wide uniqueness. Changing this for existing buckets requires a reviewed migration. | `string` | `"project-id"` | no |
+| [platform\_contract](#input\_platform\_contract) | Reviewed non-secret platform references supplied as a CLI artifact or by the Configurator. No remote-state access. | object({
schema_version = number
tenant_id = string
revision = string
organization_id = string
targets = map(object({
folder_id = string
region = string
corporate = bool
network_area_id = optional(string, null)
firewall_next_hop_ip = optional(string, null)
ipv4_nameservers = optional(list(string), null)
}))
}) | n/a | yes |
+
+## Outputs
+
+| Name | Description |
+| ---- | ----------- |
+| [application\_resources](#output\_application\_resources) | Non-secret resource references; never publish service credentials or complete state. |
+
diff --git a/src/application/README.md b/src/application/README.md
index 5c606f39..d0f2b5cf 100644
--- a/src/application/README.md
+++ b/src/application/README.md
@@ -134,3 +134,45 @@ addition to the credential-free native mock tests.
Remaining acceptance: real separately authorized two-phase CLI Plan/Apply,
backend lock/recovery, least-privilege credentials, explicit existing-state
migration and completed Configurator dispatch. Mock tests are not cloud acceptance.
+
+
+## Requirements
+
+| Name | Version |
+| ---- | ------- |
+| [terraform](#requirement\_terraform) | >= 1.11 |
+| [stackit](#requirement\_stackit) | 0.114.0 |
+| [time](#requirement\_time) | 0.14.1 |
+
+## Providers
+
+| Name | Version |
+| ---- | ------- |
+| [terraform](#provider\_terraform) | n/a |
+
+## Modules
+
+| Name | Source | Version |
+| ---- | ------ | ------- |
+| [application](#module\_application) | ../modules/landing-zone | n/a |
+
+## Resources
+
+| Name | Type |
+| ---- | ---- |
+| [terraform_data.contract](https://registry.terraform.io/providers/hashicorp/terraform/latest/docs/resources/data) | resource |
+
+## Inputs
+
+| Name | Description | Type | Default | Required |
+| ---- | ----------- | ---- | ------- | :------: |
+| [application](#input\_application) | Resolved application instance supplied manually or by the Configurator. Identity and deployment authorization are enforced by the caller's IAM permissions. | object({
configurator_execution = optional(bool, false)
tenant_id = string
instance_id = string
platform_revision = string
template_id = string
template_version = number
name = string
env = optional(string, null)
owner_email = string
target_key = string
network_enabled = optional(bool, false)
network_prefix_length = optional(number, null)
secretsmanager_enabled = bool
custom_roles = optional(list(object({
name = string
description = string
permissions = list(string)
})), [])
role_assignments = optional(list(object({
role = string
subject = string
})), [])
observability = object({
enabled = bool
plan_name = string
acl = list(string)
access_source = optional(string, "explicit-cidrs")
})
}) | n/a | yes |
+| [bucket\_naming](#input\_bucket\_naming) | Object Storage bucket naming scheme: legacy preserves existing names; project-id includes the complete owning project UUID for STACKIT-wide uniqueness. Changing this for existing buckets requires a reviewed migration. | `string` | `"project-id"` | no |
+| [platform\_contract](#input\_platform\_contract) | Reviewed non-secret platform references supplied as a CLI artifact or by the Configurator. No remote-state access. | object({
schema_version = number
tenant_id = string
revision = string
organization_id = string
targets = map(object({
folder_id = string
region = string
corporate = bool
network_area_id = optional(string, null)
firewall_next_hop_ip = optional(string, null)
ipv4_nameservers = optional(list(string), null)
}))
}) | n/a | yes |
+
+## Outputs
+
+| Name | Description |
+| ---- | ----------- |
+| [application\_resources](#output\_application\_resources) | Non-secret resource references; never publish service credentials or complete state. |
+
\ No newline at end of file
diff --git a/src/application/main.tf b/src/application/main.tf
index 50c9a9d5..b8030cad 100644
--- a/src/application/main.tf
+++ b/src/application/main.tf
@@ -45,6 +45,7 @@ module "application" {
organization_id = var.platform_contract.organization_id
parent_container_id = try(local.target.folder_id, "")
naming_pattern = local.naming_pattern
+ bucket_naming = var.bucket_naming
project_name = var.application.name
owner_email = var.application.owner_email
custom_roles = var.application.custom_roles
diff --git a/src/application/variables.tf b/src/application/variables.tf
index 021df85b..8c7ef479 100644
--- a/src/application/variables.tf
+++ b/src/application/variables.tf
@@ -1,3 +1,14 @@
+variable "bucket_naming" {
+ type = string
+ description = "Object Storage bucket naming scheme: legacy preserves existing names; project-id includes the complete owning project UUID for STACKIT-wide uniqueness. Changing this for existing buckets requires a reviewed migration."
+ default = "project-id"
+
+ validation {
+ condition = contains(["legacy", "project-id"], var.bucket_naming)
+ error_message = "Bucket naming must be legacy or project-id."
+ }
+}
+
variable "application" {
type = object({
configurator_execution = optional(bool, false)
diff --git a/src/main.tf b/src/main.tf
index d7563940..54e91a8c 100644
--- a/src/main.tf
+++ b/src/main.tf
@@ -28,6 +28,7 @@ module "management" {
organization_id = var.organization_id
labels = local.resource_labels
observability = var.observability
+ bucket_naming = var.bucket_naming
audit_logs = var.audit_logs
federated_identity_providers = var.federated_identity_providers
}
@@ -273,6 +274,7 @@ module "landing_zone" {
organization_id = var.organization_id
parent_container_id = each.value.corporate ? module.governance.folder_container_ids["landing_zones_corporate"] : module.governance.folder_container_ids["landing_zones_public"]
naming_pattern = "${var.company_code}-lz-${each.value.project_code}-${each.value.env}"
+ bucket_naming = var.bucket_naming
dns_zone_name = try("${each.value.project_code}-${each.value.env}-${var.region}-${split(".", values(module.connectivity[0].dns_zone_dns_names)[0])[0]}.stackit.run", null)
network_area_id = each.value.corporate ? try(module.connectivity[0].network_area_id[each.value.network_area_key], null) : null
corporate = each.value.corporate
@@ -296,6 +298,7 @@ module "landing_zone_eu01" {
organization_id = var.organization_id
parent_container_id = each.value.corporate ? module.governance.folder_container_ids["landing_zones_corporate"] : module.governance.folder_container_ids["landing_zones_public"]
naming_pattern = "${var.company_code}-lz-${each.value.project_code}-${each.value.env}"
+ bucket_naming = var.bucket_naming
dns_zone_name = try("${each.value.project_code}-${each.value.env}-eu01-${split(".", values(module.connectivity_eu01[0].dns_zone_dns_names)[0])[0]}.stackit.run", null)
network_area_id = each.value.corporate ? try(module.connectivity_eu01[0].network_area_id[each.value.network_area_key], null) : null
corporate = each.value.corporate
@@ -319,6 +322,7 @@ module "landing_zone_eu02" {
organization_id = var.organization_id
parent_container_id = each.value.corporate ? module.governance.folder_container_ids["landing_zones_corporate"] : module.governance.folder_container_ids["landing_zones_public"]
naming_pattern = "${var.company_code}-lz-${each.value.project_code}-${each.value.env}"
+ bucket_naming = var.bucket_naming
dns_zone_name = try("${each.value.project_code}-${each.value.env}-eu02-${split(".", values(module.connectivity_eu02[0].dns_zone_dns_names)[0])[0]}.stackit.run", null)
network_area_id = each.value.corporate ? try(module.connectivity_eu02[0].network_area_id[each.value.network_area_key], null) : null
corporate = each.value.corporate
diff --git a/src/modules/landing-zone/5-bucket.tf b/src/modules/landing-zone/5-bucket.tf
index eee8c3db..7d3512a0 100644
--- a/src/modules/landing-zone/5-bucket.tf
+++ b/src/modules/landing-zone/5-bucket.tf
@@ -1,14 +1,25 @@
+locals {
+ # Preserve the complete project UUID and purpose within S3's 63-character limit.
+ bucket_names = {
+ for purpose in ["default", "tfstate"] : purpose => (
+ var.bucket_naming == "project-id"
+ ? "${substr(var.naming_pattern, 0, 63 - length(purpose) - 38)}-${stackit_resourcemanager_project.this.project_id}-${purpose}"
+ : "${var.naming_pattern}-${purpose}"
+ )
+ }
+}
+
####################
## OBJECT STORAGE ##
####################
resource "stackit_objectstorage_bucket" "default" {
- name = "${var.naming_pattern}-default"
+ name = local.bucket_names["default"]
project_id = stackit_resourcemanager_project.this.project_id
}
resource "stackit_objectstorage_bucket" "tfstate" {
- name = "${var.naming_pattern}-tfstate"
+ name = local.bucket_names["tfstate"]
project_id = stackit_resourcemanager_project.this.project_id
depends_on = [
diff --git a/src/modules/landing-zone/README.de.md b/src/modules/landing-zone/README.de.md
index bbf24620..2c246dea 100644
--- a/src/modules/landing-zone/README.de.md
+++ b/src/modules/landing-zone/README.de.md
@@ -23,8 +23,8 @@ maßgeblich ist die [kanonische englische Referenz](README.de.md).
| Name | Version |
| ---- | ------- |
-| [stackit](#provider\_stackit) | >= 0.114.0 |
-| [time](#provider\_time) | >= 0.14.1 |
+| [stackit](#provider\_stackit) | 0.114.0 |
+| [time](#provider\_time) | 0.14.1 |
## Modules
@@ -56,6 +56,7 @@ No modules.
| Name | Description | Type | Default | Required |
| ---- | ----------- | ---- | ------- | :------: |
+| [bucket\_naming](#input\_bucket\_naming) | Object Storage bucket naming scheme: legacy preserves existing names; project-id includes the complete owning project UUID for STACKIT-wide uniqueness. Changing this for existing buckets requires a reviewed migration. | `string` | `"project-id"` | no |
| [corporate](#input\_corporate) | Whether this landing zone uses corporate networking (network area + routing). Set to false for public internet. | `bool` | `false` | no |
| [custom\_roles](#input\_custom\_roles) | List of custom roles to create for the project. | list(object({
name = string
description = string
permissions = list(string)
})) | n/a | yes |
| [dns\_zone\_name](#input\_dns\_zone\_name) | Full DNS zone domain name for this landing zone. Set to null to skip DNS zone creation. | `string` | `null` | no |
@@ -92,5 +93,6 @@ No modules.
| [project\_id](#output\_project\_id) | The project ID of the created STACKIT project. |
| [project\_name](#output\_project\_name) | The name of the created STACKIT project. |
| [project\_network](#output\_project\_network) | Non-secret reference to the managed project network, or null when no network is created. |
+| [project\_role\_counts](#output\_project\_role\_counts) | Counts of custom roles and explicit role assignments managed by this project module. |
| [secretsmanager\_instance\_id](#output\_secretsmanager\_instance\_id) | The ID of the landing zone Secrets Manager instance. |
diff --git a/src/modules/landing-zone/README.md b/src/modules/landing-zone/README.md
index 3aa100f8..9e086410 100644
--- a/src/modules/landing-zone/README.md
+++ b/src/modules/landing-zone/README.md
@@ -20,8 +20,8 @@ option preserves existing public projects without a network. The optional
| Name | Version |
| ---- | ------- |
-| [stackit](#provider\_stackit) | >= 0.114.0 |
-| [time](#provider\_time) | >= 0.14.1 |
+| [stackit](#provider\_stackit) | 0.114.0 |
+| [time](#provider\_time) | 0.14.1 |
## Modules
@@ -53,6 +53,7 @@ No modules.
| Name | Description | Type | Default | Required |
| ---- | ----------- | ---- | ------- | :------: |
+| [bucket\_naming](#input\_bucket\_naming) | Object Storage bucket naming scheme: legacy preserves existing names; project-id includes the complete owning project UUID for STACKIT-wide uniqueness. Changing this for existing buckets requires a reviewed migration. | `string` | `"project-id"` | no |
| [corporate](#input\_corporate) | Whether this landing zone uses corporate networking (network area + routing). Set to false for public internet. | `bool` | `false` | no |
| [custom\_roles](#input\_custom\_roles) | List of custom roles to create for the project. | list(object({
name = string
description = string
permissions = list(string)
})) | n/a | yes |
| [dns\_zone\_name](#input\_dns\_zone\_name) | Full DNS zone domain name for this landing zone. Set to null to skip DNS zone creation. | `string` | `null` | no |
@@ -89,5 +90,6 @@ No modules.
| [project\_id](#output\_project\_id) | The project ID of the created STACKIT project. |
| [project\_name](#output\_project\_name) | The name of the created STACKIT project. |
| [project\_network](#output\_project\_network) | Non-secret reference to the managed project network, or null when no network is created. |
+| [project\_role\_counts](#output\_project\_role\_counts) | Counts of custom roles and explicit role assignments managed by this project module. |
| [secretsmanager\_instance\_id](#output\_secretsmanager\_instance\_id) | The ID of the landing zone Secrets Manager instance. |
diff --git a/src/modules/landing-zone/tests/network.tftest.hcl b/src/modules/landing-zone/tests/network.tftest.hcl
index 49dac10f..07cc3bb2 100644
--- a/src/modules/landing-zone/tests/network.tftest.hcl
+++ b/src/modules/landing-zone/tests/network.tftest.hcl
@@ -111,6 +111,7 @@ run "objectstorage_credentials_group_name_bounded" {
variables {
naming_pattern = "app-116aee67-9384-4b50-a683-f392b6367e0d-dev"
+ bucket_naming = "legacy"
}
assert {
@@ -135,4 +136,32 @@ run "objectstorage_credentials_group_name_distinct" {
condition = length(stackit_objectstorage_credentials_group.this.name) == 32 && stackit_objectstorage_credentials_group.this.name != "${substr("app-116aee67-9384-4b50-a683-f392b6367e0d-dev", 0, 23)}-${substr(sha256("app-116aee67-9384-4b50-a683-f392b6367e0d-dev"), 0, 8)}"
error_message = "Credentials group names with a shared truncated prefix must remain distinct."
}
-}
\ No newline at end of file
+}
+run "project_qualified_bucket_defaults" {
+ command = plan
+
+ variables {
+ naming_pattern = "a-very-long-but-valid-application-resource-name-prefix"
+ }
+
+ assert {
+ condition = alltrue([
+ for name in [stackit_objectstorage_bucket.default.name, stackit_objectstorage_bucket.tfstate.name] :
+ length(name) <= 63 && strcontains(name, stackit_resourcemanager_project.this.project_id)
+ ]) && stackit_objectstorage_bucket.default.name != stackit_objectstorage_bucket.tfstate.name
+ error_message = "Workload buckets must include their full owning project UUID with distinct purposes within 63 characters."
+ }
+}
+
+run "explicit_legacy_bucket_compatibility" {
+ command = plan
+
+ variables {
+ bucket_naming = "legacy"
+ }
+
+ assert {
+ condition = stackit_objectstorage_bucket.default.name == "application-dev-default" && stackit_objectstorage_bucket.tfstate.name == "application-dev-tfstate"
+ error_message = "Explicit legacy mode must preserve existing workload bucket names."
+ }
+}
diff --git a/src/modules/landing-zone/variables.tf b/src/modules/landing-zone/variables.tf
index fc9679c0..a8bb2dd1 100644
--- a/src/modules/landing-zone/variables.tf
+++ b/src/modules/landing-zone/variables.tf
@@ -1,3 +1,14 @@
+variable "bucket_naming" {
+ type = string
+ description = "Object Storage bucket naming scheme: legacy preserves existing names; project-id includes the complete owning project UUID for STACKIT-wide uniqueness. Changing this for existing buckets requires a reviewed migration."
+ default = "project-id"
+
+ validation {
+ condition = contains(["legacy", "project-id"], var.bucket_naming)
+ error_message = "Bucket naming must be legacy or project-id."
+ }
+}
+
variable "organization_id" {
type = string
description = "Container ID of the root organization."
diff --git a/src/modules/management/3-object-storage.tf b/src/modules/management/3-object-storage.tf
index f5a7c7d7..7606dfb3 100644
--- a/src/modules/management/3-object-storage.tf
+++ b/src/modules/management/3-object-storage.tf
@@ -1,14 +1,25 @@
+locals {
+ # Preserve the complete project UUID and purpose within S3's 63-character limit.
+ bucket_names = {
+ for purpose in ["default", "tfstate", "audit-logs"] : purpose => (
+ var.bucket_naming == "project-id"
+ ? "${substr(var.naming_pattern, 0, 63 - length(purpose) - 38)}-${stackit_resourcemanager_project.this.project_id}-${purpose}"
+ : "${var.naming_pattern}-${purpose}"
+ )
+ }
+}
+
#############
## BUCKETS ##
#############
resource "stackit_objectstorage_bucket" "default" {
- name = "${var.naming_pattern}-default"
+ name = local.bucket_names["default"]
project_id = stackit_resourcemanager_project.this.project_id
}
resource "stackit_objectstorage_bucket" "tfstate" {
- name = "${var.naming_pattern}-tfstate"
+ name = local.bucket_names["tfstate"]
project_id = stackit_resourcemanager_project.this.project_id
depends_on = [
@@ -28,7 +39,7 @@ resource "stackit_objectstorage_compliance_lock" "this" {
}
resource "stackit_objectstorage_bucket" "audit_logs" {
- name = "${var.naming_pattern}-audit-logs"
+ name = local.bucket_names["audit-logs"]
project_id = stackit_resourcemanager_project.this.project_id
object_lock = try(var.audit_logs.s3_object_lock, false) ? true : null
diff --git a/src/modules/management/README.de.md b/src/modules/management/README.de.md
index 21c23ad0..e8317810 100644
--- a/src/modules/management/README.de.md
+++ b/src/modules/management/README.de.md
@@ -68,10 +68,11 @@ No modules.
| Name | Description | Type | Default | Required |
| ---- | ----------- | ---- | ------- | :------: |
| [audit\_logs](#input\_audit\_logs) | Audit logs configuration. The router forwards to two destinations: OTLP into the Logs instance for querying, and S3 into the audit bucket for long-term archive. retention\_days applies to both, driving the Logs instance retention and, when s3\_object\_lock is enabled, the archive bucket's default retention. link\_scopes defaults to a single organization-wide link; set it to attach individual folders or projects instead. | object({
retention_days = optional(number, 180)
acl = optional(list(string), null)
s3_object_lock = optional(bool, true)
link_scopes = optional(list(object({
resource_type = string # organization, folder, project
resource_id = string
})), null)
}) | `null` | no |
+| [bucket\_naming](#input\_bucket\_naming) | Management bucket naming scheme: legacy preserves existing names; project-id includes the complete management project UUID for STACKIT-wide uniqueness. Changing this for existing buckets requires a reviewed migration. | `string` | `"project-id"` | no |
| [federated\_identity\_providers](#input\_federated\_identity\_providers) | List of federated identity providers to configure for the management service account. | list(object({
name = string
issuer = string
assertions = list(object({
item = string
operator = string
value = string
}))
})) | `[]` | no |
| [labels](#input\_labels) | Additional labels to apply to all folders. | `map(string)` | `{}` | no |
| [naming\_pattern](#input\_naming\_pattern) | Naming prefix for all resources in this module, e.g. "myco-pltfm-hub-prod". | `string` | n/a | yes |
-| [observability](#input\_observability) | Observability instance configuration. Set to null to skip observability deployment. | object({
plan_name = optional(string, "Observability-Starter-EU01")
acl = optional(list(string), [])
logs_retention_days = optional(number, 30)
traces_retention_days = optional(number, 30)
metrics_retention_days = optional(number, 90)
metrics_retention_days_5m_downsampling = optional(number, 90)
metrics_retention_days_1h_downsampling = optional(number, 90)
}) | `null` | no |
+| [observability](#input\_observability) | Observability instance configuration. Omitted or null retention uses the service plan defaults. Monitoring plans require both retention fields to be omitted or null. Set to null to skip observability deployment. | object({
plan_name = optional(string, "Observability-Starter-EU01")
acl = optional(list(string), [])
logs_retention_days = optional(number)
traces_retention_days = optional(number)
metrics_retention_days = optional(number)
metrics_retention_days_5m_downsampling = optional(number)
metrics_retention_days_1h_downsampling = optional(number)
}) | `null` | no |
| [organization\_id](#input\_organization\_id) | Container ID of the root folder or organization under which the company folder will be created. | `string` | n/a | yes |
| [owner\_email](#input\_owner\_email) | Email address of the owner for the folders. Required for STACKIT resource manager. | `string` | n/a | yes |
| [parent\_container\_id](#input\_parent\_container\_id) | Parent container ID (folder or organization) where the project will be created. | `string` | n/a | yes |
diff --git a/src/modules/management/README.md b/src/modules/management/README.md
index c5db900f..b175de12 100644
--- a/src/modules/management/README.md
+++ b/src/modules/management/README.md
@@ -66,10 +66,11 @@ No modules.
| Name | Description | Type | Default | Required |
| ---- | ----------- | ---- | ------- | :------: |
| [audit\_logs](#input\_audit\_logs) | Audit logs configuration. The router forwards to two destinations: OTLP into the Logs instance for querying, and S3 into the audit bucket for long-term archive. retention\_days applies to both, driving the Logs instance retention and, when s3\_object\_lock is enabled, the archive bucket's default retention. link\_scopes defaults to a single organization-wide link; set it to attach individual folders or projects instead. | object({
retention_days = optional(number, 180)
acl = optional(list(string), null)
s3_object_lock = optional(bool, true)
link_scopes = optional(list(object({
resource_type = string # organization, folder, project
resource_id = string
})), null)
}) | `null` | no |
+| [bucket\_naming](#input\_bucket\_naming) | Management bucket naming scheme: legacy preserves existing names; project-id includes the complete management project UUID for STACKIT-wide uniqueness. Changing this for existing buckets requires a reviewed migration. | `string` | `"project-id"` | no |
| [federated\_identity\_providers](#input\_federated\_identity\_providers) | List of federated identity providers to configure for the management service account. | list(object({
name = string
issuer = string
assertions = list(object({
item = string
operator = string
value = string
}))
})) | `[]` | no |
| [labels](#input\_labels) | Additional labels to apply to all folders. | `map(string)` | `{}` | no |
| [naming\_pattern](#input\_naming\_pattern) | Naming prefix for all resources in this module, e.g. "myco-pltfm-hub-prod". | `string` | n/a | yes |
-| [observability](#input\_observability) | Observability instance configuration. Set to null to skip observability deployment. | object({
plan_name = optional(string, "Observability-Starter-EU01")
acl = optional(list(string), [])
logs_retention_days = optional(number, 30)
traces_retention_days = optional(number, 30)
metrics_retention_days = optional(number, 90)
metrics_retention_days_5m_downsampling = optional(number, 90)
metrics_retention_days_1h_downsampling = optional(number, 90)
}) | `null` | no |
+| [observability](#input\_observability) | Observability instance configuration. Omitted or null retention uses the service plan defaults. Monitoring plans require both retention fields to be omitted or null. Set to null to skip observability deployment. | object({
plan_name = optional(string, "Observability-Starter-EU01")
acl = optional(list(string), [])
logs_retention_days = optional(number)
traces_retention_days = optional(number)
metrics_retention_days = optional(number)
metrics_retention_days_5m_downsampling = optional(number)
metrics_retention_days_1h_downsampling = optional(number)
}) | `null` | no |
| [organization\_id](#input\_organization\_id) | Container ID of the root folder or organization under which the company folder will be created. | `string` | n/a | yes |
| [owner\_email](#input\_owner\_email) | Email address of the owner for the folders. Required for STACKIT resource manager. | `string` | n/a | yes |
| [parent\_container\_id](#input\_parent\_container\_id) | Parent container ID (folder or organization) where the project will be created. | `string` | n/a | yes |
diff --git a/src/modules/management/variables.tf b/src/modules/management/variables.tf
index 8c527d06..36f9b1df 100644
--- a/src/modules/management/variables.tf
+++ b/src/modules/management/variables.tf
@@ -1,3 +1,14 @@
+variable "bucket_naming" {
+ type = string
+ description = "Management bucket naming scheme: legacy preserves existing names; project-id includes the complete management project UUID for STACKIT-wide uniqueness. Changing this for existing buckets requires a reviewed migration."
+ default = "project-id"
+
+ validation {
+ condition = contains(["legacy", "project-id"], var.bucket_naming)
+ error_message = "Bucket naming must be legacy or project-id."
+ }
+}
+
variable "project_name" {
type = string
description = "Name of the STACKIT project to create."
@@ -34,14 +45,44 @@ variable "observability" {
type = object({
plan_name = optional(string, "Observability-Starter-EU01")
acl = optional(list(string), [])
- logs_retention_days = optional(number, 30)
- traces_retention_days = optional(number, 30)
- metrics_retention_days = optional(number, 90)
- metrics_retention_days_5m_downsampling = optional(number, 90)
- metrics_retention_days_1h_downsampling = optional(number, 90)
+ logs_retention_days = optional(number)
+ traces_retention_days = optional(number)
+ metrics_retention_days = optional(number)
+ metrics_retention_days_5m_downsampling = optional(number)
+ metrics_retention_days_1h_downsampling = optional(number)
})
- description = "Observability instance configuration. Set to null to skip observability deployment."
+ description = "Observability instance configuration. Omitted or null retention uses the service plan defaults. Monitoring plans require both retention fields to be omitted or null. Set to null to skip observability deployment."
default = null
+
+ validation {
+ condition = var.observability == null ? true : (
+ !startswith(var.observability.plan_name, "Observability-Monitoring-") ||
+ (var.observability.logs_retention_days == null && var.observability.traces_retention_days == null)
+ )
+ error_message = "Monitoring plans do not support logs or traces retention. Omit logs_retention_days and traces_retention_days or set them to null."
+ }
+
+ validation {
+ condition = var.observability == null ? true : (
+ !can(regex("^Observability-(Frontend|Metrics-?Endpoint)", var.observability.plan_name)) ||
+ alltrue([for value in [var.observability.logs_retention_days, var.observability.traces_retention_days, var.observability.metrics_retention_days, var.observability.metrics_retention_days_5m_downsampling, var.observability.metrics_retention_days_1h_downsampling] : value == null])
+ )
+ error_message = "Frontend and MetricsEndpoint plans do not support retention overrides. Omit all retention fields or set them to null."
+ }
+
+ validation {
+ condition = var.observability == null ? true : alltrue([
+ for value in [var.observability.logs_retention_days, var.observability.traces_retention_days] : value == null ? true : value >= 1 && value <= 30 && floor(value) == value
+ ])
+ error_message = "Logs and traces retention must be omitted, null or a whole number from 1 to 30 days."
+ }
+
+ validation {
+ condition = var.observability == null ? true : alltrue([
+ for value in [var.observability.metrics_retention_days, var.observability.metrics_retention_days_5m_downsampling, var.observability.metrics_retention_days_1h_downsampling] : value == null ? true : value >= 1 && value <= 780 && floor(value) == value
+ ])
+ error_message = "Metrics retention must be omitted, null or a whole number from 1 to 780 days."
+ }
}
variable "role_assignments" {
diff --git a/src/tests/standalone.tftest.hcl b/src/tests/standalone.tftest.hcl
index 0cf521f5..28fbdf16 100644
--- a/src/tests/standalone.tftest.hcl
+++ b/src/tests/standalone.tftest.hcl
@@ -401,3 +401,209 @@ run "standalone_local_project_network" {
error_message = "A local project network must not require connectivity or an SNA."
}
}
+
+run "management_monitoring_nullable_retention" {
+ command = plan
+
+ module {
+ source = "./modules/management"
+ }
+
+ variables {
+ naming_pattern = "tst-pltfm-mgmt-prod"
+ parent_container_id = "00000000-0000-0000-0000-000000000000"
+ observability = {
+ plan_name = "Observability-Monitoring-Medium-EU01"
+ logs_retention_days = null
+ traces_retention_days = null
+ }
+ }
+
+ assert {
+ condition = var.observability.logs_retention_days == null && var.observability.traces_retention_days == null && try(var.observability.metrics_retention_days, null) == null
+ error_message = "Monitoring must preserve omitted/null logs and traces retention while leaving metrics at the service default."
+ }
+}
+
+run "management_monitoring_rejects_logs_retention" {
+ command = plan
+
+ module {
+ source = "./modules/management"
+ }
+
+ variables {
+ naming_pattern = "tst-pltfm-mgmt-prod"
+ parent_container_id = "00000000-0000-0000-0000-000000000000"
+ observability = {
+ plan_name = "Observability-Monitoring-Medium-EU01"
+ logs_retention_days = 14
+ }
+ }
+
+ expect_failures = [var.observability]
+}
+
+run "management_observability_preserves_explicit_retention" {
+ command = plan
+
+ module {
+ source = "./modules/management"
+ }
+
+ variables {
+ naming_pattern = "tst-pltfm-mgmt-prod"
+ parent_container_id = "00000000-0000-0000-0000-000000000000"
+ observability = {
+ plan_name = "Observability-Medium-EU01"
+ logs_retention_days = 14
+ traces_retention_days = 7
+ }
+ }
+
+ assert {
+ condition = stackit_observability_instance.this[0].logs_retention_days == 14 && stackit_observability_instance.this[0].traces_retention_days == 7
+ error_message = "Explicit retention values must survive unchanged for a full Observability plan."
+ }
+}
+
+run "root_monitoring_omits_unsupported_retention" {
+ command = plan
+
+ variables {
+ observability = {
+ plan_name = "Observability-Monitoring-Medium-EU01"
+ }
+ }
+
+ assert {
+ condition = try(var.observability.logs_retention_days, null) == null && try(var.observability.traces_retention_days, null) == null
+ error_message = "Root defaults must not inject unsupported log or trace retention into Monitoring plans."
+ }
+}
+
+run "root_monitoring_rejects_traces_retention" {
+ command = plan
+
+ variables {
+ observability = {
+ plan_name = "Observability-Monitoring-Medium-EU01"
+ traces_retention_days = 14
+ }
+ }
+
+ expect_failures = [var.observability]
+}
+
+run "management_project_unique_bucket_defaults" {
+ command = plan
+
+ module {
+ source = "./modules/management"
+ }
+
+ variables {
+ naming_pattern = "a-very-long-but-valid-management-resource-name-prefix"
+ parent_container_id = "00000000-0000-0000-0000-000000000000"
+ }
+
+ assert {
+ condition = alltrue([
+ for name in [stackit_objectstorage_bucket.default.name, stackit_objectstorage_bucket.tfstate.name, stackit_objectstorage_bucket.audit_logs.name] :
+ length(name) <= 63 && strcontains(name, stackit_resourcemanager_project.this.project_id)
+ ]) && length(toset([stackit_objectstorage_bucket.default.name, stackit_objectstorage_bucket.tfstate.name, stackit_objectstorage_bucket.audit_logs.name])) == 3
+ error_message = "All bucket defaults must contain the full project UUID, remain distinct and fit the S3 name limit."
+ }
+}
+
+run "management_legacy_bucket_names_require_explicit_choice" {
+ command = plan
+
+ module {
+ source = "./modules/management"
+ }
+
+ variables {
+ naming_pattern = "tst-pltfm-mgmt-prod"
+ parent_container_id = "00000000-0000-0000-0000-000000000000"
+ bucket_naming = "legacy"
+ }
+
+ assert {
+ condition = stackit_objectstorage_bucket.default.name == "tst-pltfm-mgmt-prod-default" && stackit_objectstorage_bucket.tfstate.name == "tst-pltfm-mgmt-prod-tfstate" && stackit_objectstorage_bucket.audit_logs.name == "tst-pltfm-mgmt-prod-audit-logs"
+ error_message = "Explicit legacy mode must retain all existing bucket names exactly."
+ }
+}
+
+run "frontend_omits_all_retention_overrides" {
+ command = plan
+
+ variables {
+ observability = {
+ plan_name = "Observability-Frontend-Starter-EU01"
+ }
+ }
+}
+
+run "frontend_rejects_metrics_override" {
+ command = plan
+
+ variables {
+ observability = {
+ plan_name = "Observability-Frontend-Starter-EU01"
+ metrics_retention_days = 90
+ }
+ }
+
+ expect_failures = [var.observability]
+}
+
+run "observability_rejects_invalid_trace_retention" {
+ command = plan
+
+ variables {
+ observability = {
+ traces_retention_days = 31
+ }
+ }
+
+ expect_failures = [var.observability]
+}
+
+run "management_identical_prefix_distinct_project" {
+ command = plan
+
+ module {
+ source = "./modules/management"
+ }
+
+ variables {
+ naming_pattern = "a-very-long-but-valid-management-resource-name-prefix"
+ parent_container_id = "00000000-0000-0000-0000-000000000000"
+ }
+
+ override_resource {
+ target = stackit_resourcemanager_project.this
+ values = {
+ project_id = "99999999-9999-4999-8999-999999999999"
+ }
+ }
+
+ assert {
+ condition = stackit_objectstorage_bucket.tfstate.name != "${substr(var.naming_pattern, 0, 18)}-11111111-1111-4111-8111-111111111111-tfstate" && strcontains(stackit_objectstorage_bucket.tfstate.name, "99999999-9999-4999-8999-999999999999")
+ error_message = "Identical naming prefixes in distinct projects must produce distinct bucket names using the full immutable UUID."
+ }
+}
+
+run "metrics_endpoint_rejects_retention_override" {
+ command = plan
+
+ variables {
+ observability = {
+ plan_name = "Observability-Metrics-Endpoint-100k-EU01"
+ metrics_retention_days = 90
+ }
+ }
+
+ expect_failures = [var.observability]
+}
diff --git a/src/variables.tf b/src/variables.tf
index e83ce485..e7f9bf83 100644
--- a/src/variables.tf
+++ b/src/variables.tf
@@ -1,3 +1,14 @@
+variable "bucket_naming" {
+ type = string
+ description = "Object Storage bucket naming scheme: legacy preserves existing names; project-id includes the complete owning project UUID for STACKIT-wide uniqueness. Changing this for existing buckets requires a reviewed migration."
+ default = "project-id"
+
+ validation {
+ condition = contains(["legacy", "project-id"], var.bucket_naming)
+ error_message = "Bucket naming must be legacy or project-id."
+ }
+}
+
#############
## GENERAL ##
#############
@@ -185,14 +196,44 @@ variable "observability" {
type = object({
plan_name = optional(string, "Observability-Starter-EU01")
acl = optional(list(string), [])
- logs_retention_days = optional(number, 30)
- traces_retention_days = optional(number, 30)
- metrics_retention_days = optional(number, 90)
- metrics_retention_days_5m_downsampling = optional(number, 90)
- metrics_retention_days_1h_downsampling = optional(number, 90)
+ logs_retention_days = optional(number)
+ traces_retention_days = optional(number)
+ metrics_retention_days = optional(number)
+ metrics_retention_days_5m_downsampling = optional(number)
+ metrics_retention_days_1h_downsampling = optional(number)
})
- description = "Observability instance configuration for the management module. Set to null to skip observability deployment."
+ description = "Observability instance configuration for the management module. Omitted or null retention uses the service plan defaults. Monitoring plans require both retention fields to be omitted or null. Set to null to skip observability deployment."
default = null
+
+ validation {
+ condition = var.observability == null ? true : (
+ !startswith(var.observability.plan_name, "Observability-Monitoring-") ||
+ (var.observability.logs_retention_days == null && var.observability.traces_retention_days == null)
+ )
+ error_message = "Monitoring plans do not support logs or traces retention. Omit logs_retention_days and traces_retention_days or set them to null."
+ }
+
+ validation {
+ condition = var.observability == null ? true : (
+ !can(regex("^Observability-(Frontend|Metrics-?Endpoint)", var.observability.plan_name)) ||
+ alltrue([for value in [var.observability.logs_retention_days, var.observability.traces_retention_days, var.observability.metrics_retention_days, var.observability.metrics_retention_days_5m_downsampling, var.observability.metrics_retention_days_1h_downsampling] : value == null])
+ )
+ error_message = "Frontend and MetricsEndpoint plans do not support retention overrides. Omit all retention fields or set them to null."
+ }
+
+ validation {
+ condition = var.observability == null ? true : alltrue([
+ for value in [var.observability.logs_retention_days, var.observability.traces_retention_days] : value == null ? true : value >= 1 && value <= 30 && floor(value) == value
+ ])
+ error_message = "Logs and traces retention must be omitted, null or a whole number from 1 to 30 days."
+ }
+
+ validation {
+ condition = var.observability == null ? true : alltrue([
+ for value in [var.observability.metrics_retention_days, var.observability.metrics_retention_days_5m_downsampling, var.observability.metrics_retention_days_1h_downsampling] : value == null ? true : value >= 1 && value <= 780 && floor(value) == value
+ ])
+ error_message = "Metrics retention must be omitted, null or a whole number from 1 to 780 days."
+ }
}
variable "audit_logs" {