feat: migrate starterkit tenants to meshstack_tenant (anticipates provider v0.24.0) by grubmeshi · Pull Request #226 · meshcloud/meshstack-hub

grubmeshi · 2026-07-16T07:49:06Z

Depends on: terraform-provider-meshstack v0.24.0 release

This migration targets the ref-based meshstack_tenant that ships in provider v0.24.0, so the
touched modules bump their meshstack floor to >= 0.24.0 (buildingblock versions.tf and the
meshstack_integration.tf required_providers).

Do not merge until v0.24.0 is published to the registry. The modules pin >= 0.24.0, so
consumers (IaC runtimes) can't terraform init/plan against them until the release is out — the
ref-based meshstack_tenant body and the moved chains only resolve on v0.24.0. Note: hub CI here
is green because module validation is structural (README/fmt/layout via ci/validate_modules.sh),
not a provider-resolving init/validate, so a green build does not imply the provider is available
yet. Provider PR stack:

feat: meshstack_tenant on the v4 tenant API; deprecate meshstack_tenant_v4 (CU-86c0j0r7q) terraform-provider-meshstack#226 — B0: back meshstack_tenant with the meshTenant v4 API + moved-block migration from meshstack_tenant_v4 (the change this PR consumes)
feat!: move tenant resources to the meshTenant v4 GA media type (CU-86c0j0r7q) terraform-provider-meshstack#227 — B1 (on B0): flip the tenant client to the GA media type

Backend context (meshfed-release): the v4 tenant API landed via #10308 (merged); GA promotion is #10309.

What

Migrates the meshstack_tenant_v4 usages in the aks and ske starterkits to the reworked
meshstack_tenant, plus an aks address-management refactor:

feat(aks/starterkit) — migrate dev + prod tenants to meshstack_tenant
feat(ske/ske-starterkit) — migrate this (for_each over landing zones) + e2e wiring
refactor(aks/starterkit) — drive the per-stage aks resources (projects, bindings, tenants,
GHA connectors) with for_each keyed by stage instead of spelled-out dev/prod, matching the
ske shape

Each tenant move is a non-destructive moved { from = meshstack_tenant_v4.X, to = meshstack_tenant.X }
(both share the v4 body, so state upgrades in place — no tenant recreate). The aks for_each refactor
adds moved blocks that map the deployed addresses directly to the new for_each keys in a single
hop (folding in the in-flight meshstack_tenant_v4→meshstack_tenant and
meshstack_building_block_v2→meshstack_building_block type migrations), so the address change alone
never recreates a resource.

The azure-virtual-machine-starterkit is intentionally not included — it's slated for removal/rework.

Ref-based body → aligned inputs

v0.24.0 references platform and landing zone by ref, so both starterkits now take the same two
tenant-ref inputs, wired identically as static BBD inputs (positioned together):

platform_ref — object({ uuid, kind }), by uuid. Sourced from the platform/backplane that
owns the meshstack_platform (its .ref).
landing_zone_refs — map(object({ name, kind })) keyed by stage (dev/prod), by name.

This replaces the previous full_platform_identifier + per-stage landing-zone identifier inputs
(addresses the review feedback to align ske/aks and treat landing zones like platform_ref).
full_platform_identifier is dropped entirely: where it fed meshPanel deep-links, a
meshstack_platform data source keyed by platform_ref.uuid supplies the computed .identifier.

Breaking change for consumers

Both starterkits replace full_platform_identifier + landing-zone identifier inputs with
platform_ref + landing_zone_refs. Integrations/consumers must supply the refs (e.g.
meshstack_platform.<x>.ref, meshstack_landingzone.<x>.ref).

Notes

READMEs regenerated with the nix-pinned terraform-docs v0.20.0 (repo's canonical version).
Open design point: ideally the backplane owns the meshPlatform/landing zones and exports the refs
so the integration wires them directly — this PR takes them as static BBD inputs, the minimal
shape of that pattern.

🤖 Generated with Claude Code

github-actions · 2026-07-16T07:49:17Z

Scorecard Check

Scorecard run on commit 06b80bdf27c46be50c7b2d1a12ff5fcab2afe87f relative to origin/main

📊 meshstack-hub Module Scorecard

Generated: 2026-07-16 | Modules scanned: 2 | Categories: 5

📋 Per-Module Category Summary

Score per category per building block. n/a = category does not apply to this module.

Module	Overall	Core Structure	Integration	Azure Backplane	STACKIT Backplane	Testing
`aks/starterkit`	🟢 82%	🟢 100%	🟢 92%	n/a	n/a	🔴 0%
`ske/ske-starterkit`	🟢 91%	🟢 100%	🟢 92%	n/a	n/a	🟡 67%

⚠️ 2 modules have failing checks — failing categories are expanded below.

Core Structure — ✅ all passing

Basic module file structure and documentation — applies to 2 modules

Module	Score	📦	🔗	📋	📝	🖼️	📌	🔒
`aks/starterkit`	🟢 100%	✅	✅	➖	✅	✅	✅	✅
`ske/ske-starterkit`	🟢 100%	✅	✅	➖	✅	✅	✅	✅

Core Structure — Summary

Emoji	Criterion	Coverage	Status
📦	buildingblock/ directory exists	2/2	🟢 100%
🔗	meshstack_integration.tf present	2/2	🟢 100%
📋	buildingblock/APP_TEAM_README.md present (no-integration fallback)	n/a	—
📝	buildingblock/README.md with YAML front-matter	2/2	🟢 100%
🖼️	buildingblock/logo.png included	2/2	🟢 100%
📌	buildingblock/versions.tf present	2/2	🟢 100%
🔒	Provider versions use minimum constraint (>=)	2/2	🟢 100%

Integration — some checks failing

meshstack_integration.tf conventions — applies to 2 modules

Module	Score	🏷️	🏢	📤	🔌	📎	🔀	📋	🏷️	🧱	📖	📝	📊	🚫	🔄
`aks/starterkit`	🟢 92%	✅	✅	✅	✅	✅	✅	✅	✅	❌	✅	✅	✅	✅	➖
`ske/ske-starterkit`	🟢 92%	✅	✅	✅	✅	✅	✅	✅	✅	❌	✅	✅	✅	✅	➖

Integration — Summary

Emoji	Criterion	Coverage	Status
🏷️	variable "hub" in integration	2/2	🟢 100%
🏢	variable "meshstack" in integration	2/2	🟢 100%
📤	building_block_definition output exposed	2/2	🟢 100%
🔌	meshcloud/meshstack in required_providers	2/2	🟢 100%
📎	backplane source uses var.hub.git_ref	2/2	🟢 100%
🔀	ref_name uses var.hub.git_ref	2/2	🟢 100%
📋	version_spec.draft uses var.hub.bbd_draft	2/2	🟢 100%
🏷️	BBD metadata.tags forwards var.meshstack.tags	2/2	🟢 100%
🧱	BBD input argument vars with optional() have explicit defaults	0/2	🔴 0%
📖	BBD readme field present	2/2	🟢 100%
📝	BBD readme starts with plain-text description (no heading)	2/2	🟢 100%
📊	BBD readme has shared responsibility table (✅/❌)	2/2	🟢 100%
🚫	No documentation_md output in backplane	2/2	🟢 100%
🔄	meshstack_platform has lifecycle ignore_changes = [availability]	n/a	—

Azure Backplane — not applicable

Azure UAMI-based automation principal conventions — applies to 0 modules

No applicable modules.

STACKIT Backplane — not applicable

STACKIT WIF-based automation principal conventions — applies to 0 modules

No applicable modules.

Testing — some checks failing

End-to-end test coverage — applies to 2 modules

Module	Score	⚙️	🧪	✅
`aks/starterkit`	🔴 0%	❌	❌	❌
`ske/ske-starterkit`	🟡 67%	❌	✅	✅

Testing — Summary

Emoji	Criterion	Coverage	Status
⚙️	backplane/ directory (optional tier)	0/2	🔴 0%
🧪	e2e/ test directory exists	1/2	🟡 50%
✅	e2e/ contains .tftest.hcl files	1/2	🟡 50%

📈 Overall Summary

Overall Average Score: 87%

Score Distribution

🟢 High maturity (≥80%): 2 modules
🟡 Medium maturity (50–79%): 0 modules
🔴 Low maturity (<50%): 0 modules

aws-amplify-eu-central-1 · 2026-07-16T07:53:39Z

This pull request is automatically being deployed by Amplify Hosting (learn more).

Access this pull request here: https://pr-226.d1o16zfeoh2slu.amplifyapp.com

…r v0.24.0 Anticipates terraform-provider-meshstack #226 (v0.24.0), which reworks meshstack_tenant onto the meshTenant v4 API and deprecates meshstack_tenant_v4. The aks, ske and azure-virtual-machine starterkits move their meshstack_tenant_v4 usages to meshstack_tenant via `moved` blocks (both share the v4 body, so the move upgrades state in place). The v4 body references platform and landing zone by ref: - spec.platform_ref (by uuid): wired into each buildingblock as a new static BBD input `platform_ref`, sourced from the platform/backplane that owns the meshPlatform (its `.ref`). - spec.landing_zone_ref (by name): built in place from the existing landing zone identifier(s). The redundant `full_platform_identifier` input is dropped: where it was only used for meshPanel deep-links, a `meshstack_platform` data source (keyed by platform_ref.uuid) now supplies the computed `.identifier`. Provider version floor bumped to >= 0.24.0. DRAFT: hub CI (`tf validate`) stays red until v0.24.0 is published, since the ref-based meshstack_tenant body only exists there. Docs generated with the nix-pinned terraform-docs v0.20.0. BREAKING CHANGE: the aks/ske/azure-vm starterkit building blocks replace the `full_platform_identifier` input with a `platform_ref` object input. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

grubmeshi · 2026-07-16T13:34:54Z

-    platform_identifier     = var.full_platform_identifier
-    landing_zone_identifier = var.landing_zone_dev_identifier
+    platform_ref     = var.platform_ref
+    landing_zone_ref = { name = var.landing_zone_dev_identifier }


f: that could be aligned more, as the lz resource has some "ref" output now (in anticipated version), so we can write (after wired through via static input from BBD), similar as platform ref:

Suggested change

landing_zone_ref = { name = var.landing_zone_dev_identifier }

landing_zone_ref = var.landing_zone_ref

grubmeshi · 2026-07-16T13:37:47Z

f: move this closer to tenant refs, merge dev/prod identifiers to landing_zone_refs (see ske starterkit)

grubmeshi · 2026-07-16T13:38:26Z

+        # jsonencode twice is correct for structured inputs, see landing_zone_identifiers below.
+        argument = jsonencode(jsonencode(var.platform_ref))
      }
      "landing_zone_identifiers" = {


f: align (see other comments)

Suggested change

"landing_zone_identifiers" = {

"landing_zone_refs" = {

grubmeshi · 2026-07-16T13:40:39Z

Suggested change

variable "landing_zone_refs" {

type = map(object({ name = string, kind = optional(string, "meshLandingZone")})

})

description = "map keys are the stages, usually dev and prod"

}

…ovider v0.24.0 Move meshstack_tenant_v4 (dev, prod) to meshstack_tenant via `moved` blocks (both share the v4 body, so state upgrades in place), anticipating terraform-provider-meshstack #226 (v0.24.0). The v4 body references platform and landing zone by ref, wired in as static BBD inputs: - platform_ref (by uuid): new object input, sourced from the platform/backplane `.ref` - landing_zone_refs (by name): new map input keyed by stage (dev/prod), replacing the landing_zone_dev/prod_identifier string inputs full_platform_identifier is dropped; meshPanel deep-links resolve the platform's `.identifier` via a meshstack_platform data source keyed by platform_ref.uuid. Provider floor -> >= 0.24.0. BREAKING CHANGE: the aks starterkit building block replaces full_platform_identifier and landing_zone_dev/prod_identifier with platform_ref and landing_zone_refs inputs. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

…f provider v0.24.0 Move meshstack_tenant_v4 (for_each over landing zones) to meshstack_tenant via a `moved` block, anticipating terraform-provider-meshstack #226 (v0.24.0). Same ref-based wiring as the aks starterkit: platform_ref (by uuid) + landing_zone_refs (map of {name, kind} keyed by stage) as static BBD inputs, replacing full_platform_identifier / landing_zone_identifiers. The e2e platform test module gains platform_ref and landing_zone_refs outputs. Provider floor -> >= 0.24.0. BREAKING CHANGE: the ske starterkit building block replaces full_platform_identifier and landing_zone_identifiers with platform_ref and landing_zone_refs inputs. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Replace the spelled-out dev/prod projects, project user bindings, tenants and GitHub Actions connectors with single for_each resources keyed off var.landing_zone_refs (no local stage map), matching the ske starterkit. Per-stage values are indexed by the stage key and fail if absent (no lookup defaults): project_tags[each.key] and a small github_environment_names map (dev->development, prod->production); the app domain is derived inline (prod has no suffix). project_tags aligns to ske's shape - adds optional owner_tag_key with the owner-tag merge and drops the {} default. Purely a Terraform address-management change (no behavioural change). `moved` blocks are chained so nothing is recreated: hop 1 is the resource-type migration (meshstack_tenant_v4 -> meshstack_tenant; meshstack_building_block_v2 -> meshstack_building_block), hop 2 is the dev/prod -> for_each address change. Terraform follows the chain. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

grubmeshi force-pushed the feat-migrate-tenant-v4-to-tenant branch from 89178e6 to 9f252c8 Compare July 16, 2026 13:24

grubmeshi marked this pull request as ready for review July 16, 2026 13:24

grubmeshi commented Jul 16, 2026

View reviewed changes

grubmeshi and others added 2 commits July 16, 2026 15:48

grubmeshi force-pushed the feat-migrate-tenant-v4-to-tenant branch from 9f252c8 to b8bcb2e Compare July 16, 2026 13:48

grubmeshi force-pushed the feat-migrate-tenant-v4-to-tenant branch from 5139f01 to d3c0b33 Compare July 16, 2026 14:40

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat: migrate starterkit tenants to meshstack_tenant (anticipates provider v0.24.0)#226

feat: migrate starterkit tenants to meshstack_tenant (anticipates provider v0.24.0)#226
grubmeshi wants to merge 3 commits into
mainfrom
feat-migrate-tenant-v4-to-tenant

grubmeshi commented Jul 16, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Jul 16, 2026 •

edited

Loading

Core Structure — Summary

Integration — Summary

Testing — Summary

Uh oh!

aws-amplify-eu-central-1 Bot commented Jul 16, 2026

Uh oh!

grubmeshi Jul 16, 2026

Uh oh!

grubmeshi Jul 16, 2026

Uh oh!

grubmeshi Jul 16, 2026

Uh oh!

grubmeshi Jul 16, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

	landing_zone_ref = { name = var.landing_zone_dev_identifier }
	landing_zone_ref = var.landing_zone_ref

+variable "landing_zone_refs" {
+type = map(object({ name = string, kind = optional(string, "meshLandingZone")})
+})
+description = "map keys are the stages, usually dev and prod"
+}

Uh oh!

Conversation

grubmeshi commented Jul 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Depends on: terraform-provider-meshstack v0.24.0 release

What

Ref-based body → aligned inputs

Breaking change for consumers

Notes

Uh oh!

github-actions Bot commented Jul 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Scorecard Check

📊 meshstack-hub Module Scorecard

📋 Per-Module Category Summary

Core Structure — Summary

Integration — Summary

Testing — Summary

📈 Overall Summary

Overall Average Score: 87%

Score Distribution

Uh oh!

aws-amplify-eu-central-1 Bot commented Jul 16, 2026

Uh oh!

grubmeshi Jul 16, 2026

Choose a reason for hiding this comment

Uh oh!

grubmeshi Jul 16, 2026

Choose a reason for hiding this comment

Uh oh!

grubmeshi Jul 16, 2026

Choose a reason for hiding this comment

Uh oh!

grubmeshi Jul 16, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

grubmeshi commented Jul 16, 2026 •

edited

Loading

github-actions Bot commented Jul 16, 2026 •

edited

Loading