Skip to content

feat(ref-arch/stackit-kubernetes)!: summaries, portal buttons and display names for the STACKIT platform - #433

Merged
grubmeshi merged 28 commits into
mainfrom
feature/ske-ref-arch-followups
Nov 6, 2026
Merged

feat(ref-arch/stackit-kubernetes)!: summaries, portal buttons and display names for the STACKIT platform#433
grubmeshi merged 28 commits into
mainfrom
feature/ske-ref-arch-followups

Conversation

@grubmeshi

@grubmeshi grubmeshi commented Nov 6, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator

ske-ref-arch-followups

Follow-ups to the STACKIT Kubernetes Platform migration: what people see on the building blocks and in the docs.

Breaking: imports.project.display_name is removed. The imports JSON schema rejects it, so callers drop the key; ICF, LCF and TCF do that with their Hub bump.

Other behavior changes:

  • New summary and button outputs change the content hash of several child definitions, so the nested run updates those children on the bump. Forgejo Connector is an app-team definition and needs the release cycle in LCF and TCF.
  • Adopted projects are renamed to STACKIT Kubernetes Platform <id> and the nested building block to STACKIT Kubernetes Platform Services <id>, both in place.
  • The kubeconfig output of kubernetes/service-account is no longer sensitive in OpenTofu; meshStack shows it in plain text anyway, and its definition comment points to output_to_vault.

What the PR does:

  • Summaries: SKE Cluster, STACKIT Git Instance, Kubernetes Ingress, SKE Forgejo Connector, Kubernetes Service Account and STACKIT Git Runner get a Markdown summary output with names, links, the Vault paths of their secrets (no values) and next steps.
  • Scorecard: the integration check summary_output (a SUMMARY output in the definition and output "summary" in buildingblock/), documented in terraform-conventions.md. Only the STACKIT modules are fixed here.
  • Buttons: every STACKIT and SKE building block with a page of its own has an "Open …" button: new ones for Forgejo, the federated service account, Forgejo Actions, the Forgejo runners, the server, and "Open Portal" next to Forgejo, Harbor and the AI token; DNS zone, service account, network and network area buttons renamed to that style. A resource's own UI comes first, the STACKIT portal second.
  • Portal links: SKE cluster, DNS zone, service account and project links use the portal's current pages (/<service>/…/overview?project=<id>, /dashboard?project=<id>). The Container Registry summary links the Harbor repositories and robot accounts.
  • Display names: display_name_template names the outer building blocks STACKIT Kubernetes Platform <id> and STACKIT Landing Zone <id>; foundations set the same string.
  • STACKIT Landing Zone summary: the whole "Build a Kubernetes platform on top" part sits inside its tip, and it explains the default landing zone variant.
  • Docs: a README section on how the starter kit reaches application teams. The building block tree shows only building blocks and their parents; the platform-team diagram names the meshProject and meshTenant; the app-team diagram shows the demo app inside the namespace.
  • Kubernetes modules: comments, descriptions and readmes name STACKIT only as an example.

Cross-repo PRs

🤖 Generated with Claude Code

@github-actions

github-actions Bot commented Nov 6, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Scorecard Check

Scorecard run on commit 3b7525d52313944d424d89d032a467806f0aba2c relative to origin/main

kubernetes/platform

Not a scored module (deleted?).

📊 meshstack-hub Module Scorecard

Generated: 2026-11-06 | Modules scanned: 17 | Categories: 8

📋 Per-Module Category Summary

Score per category per module. n/a = category does not apply to this module.

Module Overall Core Structure Integration AWS Backplane Azure Backplane GCP Backplane STACKIT Backplane Shared Practices Testing
kubernetes/ingress 🟢 84% 🟢 100% 🟢 100% n/a n/a n/a n/a 🔴 40% 🔴 33%
kubernetes/manifest 🟢 90% 🟢 100% 🟢 94% n/a n/a n/a n/a 🟢 100% 🟡 50%
kubernetes/service-account 🟢 83% 🟢 100% 🟢 100% n/a n/a n/a n/a 🔴 40% 🔴 33%
ske/cluster 🟢 81% 🟢 100% 🟢 100% n/a n/a n/a n/a 🔴 40% 🔴 25%
ske/forgejo-connector 🟢 89% 🟢 100% 🟢 100% n/a n/a n/a n/a 🟡 50% 🟡 50%
stackit/ai-llm 🟢 84% 🟢 100% 🟢 100% n/a n/a n/a n/a 🟡 60% 🔴 25%
stackit/container-registry 🟢 81% 🟢 100% 🟢 100% n/a n/a n/a n/a 🔴 40% 🔴 25%
stackit/dns 🟢 83% 🟢 100% 🟢 100% n/a n/a n/a n/a 🟡 50% 🔴 25%
stackit/git 🟡 78% 🟢 86% 🟢 100% n/a n/a n/a n/a 🔴 40% 🔴 25%
stackit/git-runner 🟢 83% 🟢 100% 🟢 100% n/a n/a n/a n/a 🟡 50% 🔴 25%
stackit/network 🟢 97% 🟢 100% 🟢 100% n/a n/a n/a 🟢 100% 🟡 75% 🟢 100%
stackit/network-area 🟢 97% 🟢 100% 🟢 100% n/a n/a n/a 🟢 100% 🟡 75% 🟢 100%
stackit/project 🟢 86% 🟢 100% 🟡 78% n/a n/a n/a 🟢 100% 🟡 67% 🟢 100%
stackit/server 🟢 92% 🟢 100% 🟢 100% n/a n/a n/a 🟢 100% 🔴 25% 🟢 100%
stackit/service-account 🟢 97% 🟢 100% 🟢 100% n/a n/a n/a 🟢 100% 🟡 75% 🟢 100%
stackit/service-account-federation 🟢 100% 🟢 100% 🟢 100% n/a n/a n/a 🟢 100% 🟢 100% 🟢 100%
stackit/stackit-project-starterkit 🟢 93% 🟢 100% 🟢 100% n/a n/a n/a n/a 🟢 100% 🔴 33%

⚠️ 16 modules have failing checks — failing categories are expanded below.

Core Structure — some checks failing

Basic module file structure and documentation — applies to 17 modules

Module Score 📦 🔗 📋 📝 🖼️ 📌 🚦 🩹 🧼 ❄️ 🔒
kubernetes/ingress 🟢 100% ✅ ✅ ➖ ✅ ✅ ✅ ➖ ✅ ➖ ➖ ✅
kubernetes/manifest 🟢 100% ✅ ✅ ➖ ✅ ✅ ✅ ➖ ✅ ➖ ➖ ✅
kubernetes/service-account 🟢 100% ✅ ✅ ➖ ✅ ✅ ✅ ➖ ➖ ➖ ➖ ✅
ske/cluster 🟢 100% ✅ ✅ ➖ ✅ ✅ ✅ ➖ ➖ ➖ ➖ ✅
ske/forgejo-connector 🟢 100% ✅ ✅ ➖ ✅ ✅ ✅ ➖ ➖ ➖ ➖ ✅
stackit/ai-llm 🟢 100% ✅ ✅ ➖ ✅ ✅ ✅ ➖ ➖ ➖ ➖ ✅
stackit/container-registry 🟢 100% ✅ ✅ ➖ ✅ ✅ ✅ ➖ ➖ ✅ ➖ ✅
stackit/dns 🟢 100% ✅ ✅ ➖ ✅ ✅ ✅ ➖ ➖ ➖ ➖ ✅
stackit/git 🟢 86% ✅ ✅ ➖ ✅ ✅ ✅ ➖ ❌ ➖ ➖ ✅
stackit/git-runner 🟢 100% ✅ ✅ ➖ ✅ ✅ ✅ ➖ ➖ ➖ ➖ ✅
stackit/network 🟢 100% ✅ ✅ ➖ ✅ ✅ ✅ ➖ ➖ ➖ ➖ ✅
stackit/network-area 🟢 100% ✅ ✅ ➖ ✅ ✅ ✅ ➖ ➖ ➖ ➖ ✅
stackit/project 🟢 100% ✅ ✅ ➖ ✅ ✅ ✅ ➖ ➖ ✅ ➖ ✅
stackit/server 🟢 100% ✅ ✅ ➖ ✅ ✅ ✅ ➖ ✅ ➖ ➖ ✅
stackit/service-account 🟢 100% ✅ ✅ ➖ ✅ ✅ ✅ ➖ ➖ ➖ ➖ ✅
stackit/service-account-federation 🟢 100% ✅ ✅ ➖ ✅ ✅ ✅ ➖ ✅ ➖ ➖ ✅
stackit/stackit-project-starterkit 🟢 100% ✅ ✅ ➖ ✅ ✅ ✅ ✅ ✅ ➖ ➖ ✅

Core Structure — Summary

Emoji Criterion Coverage Status
📦 buildingblock/ directory exists 17/17 🟢 100%
🔗 meshstack_integration.tf present 17/17 🟢 100%
📋 buildingblock/APP_TEAM_README.md present (no-integration fallback) n/a —
📝 buildingblock/README.md with YAML front-matter 17/17 🟢 100%
🖼️ buildingblock/logo.png or logo.svg included 17/17 🟢 100%
📌 buildingblock/versions.tf present 17/17 🟢 100%
🚦 Child meshstack_building_block asserts a SUCCEEDED run 1/1 🟢 100%
🩹 Every try() carries a comment saying why 5/6 🟢 83%
🧼 Pre-run scripts install no tools on the runner 2/2 🟢 100%
❄️ A module flake sits in nix/, is pinned, and Terraform calls it n/a —
🔒 Provider versions float within one major (>= X.Y.Z, < N.0.0) 17/17 🟢 100%
Integration — some checks failing

meshstack_integration.tf conventions — applies to 17 modules

Module Score 🏷️ 🏢 📤 🔌 📎 🔀 🌱 📋 🏷️ 🧱 🏪 📖 📝 📊 🚫 🔄 🗒️ 🪪
kubernetes/ingress 🟢 100% ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ➖ ✅ ➖
kubernetes/manifest 🟢 94% ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ➖ ❌ ➖
kubernetes/service-account 🟢 100% ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ➖ ✅ ➖
ske/cluster 🟢 100% ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ➖ ✅ ➖
ske/forgejo-connector 🟢 100% ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ➖ ✅ ➖
stackit/ai-llm 🟢 100% ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ➖ ✅ ➖
stackit/container-registry 🟢 100% ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ➖ ✅ ➖
stackit/dns 🟢 100% ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ➖ ✅ ➖
stackit/git 🟢 100% ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ➖ ✅ ➖
stackit/git-runner 🟢 100% ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ➖ ✅ ➖
stackit/network 🟢 100% ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ➖ ✅ ✅
stackit/network-area 🟢 100% ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ➖ ✅ ✅
stackit/project 🟡 78% ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ❌ ❌ ❌ ❌ ✅ ✅ ✅ ✅
stackit/server 🟢 100% ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ➖ ✅ ✅
stackit/service-account 🟢 100% ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ➖ ✅ ✅
stackit/service-account-federation 🟢 100% ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ➖ ✅ ✅
stackit/stackit-project-starterkit 🟢 100% ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ➖ ✅ ➖

Integration — Summary

Emoji Criterion Coverage Status
🏷️ variable "hub" in integration 17/17 🟢 100%
🏢 variable "meshstack" in integration 17/17 🟢 100%
📤 building_block_definition output exposed 17/17 🟢 100%
🔌 meshcloud/meshstack in required_providers 17/17 🟢 100%
📎 backplane source uses var.hub.git_ref 17/17 🟢 100%
🔀 ref_name uses var.hub.git_ref 17/17 🟢 100%
🌱 BBD terraform_version >= 1.12.0 17/17 🟢 100%
📋 version_spec.draft uses var.hub.bbd_draft 17/17 🟢 100%
🏷️ BBD metadata.tags forwards var.meshstack.tags 17/17 🟢 100%
🧱 BBD input argument vars with optional() have explicit defaults 17/17 🟢 100%
🏪 BBD catalog properties are overridable 16/17 🟢 94%
📖 BBD readme field present 16/17 🟢 94%
📝 BBD readme starts with plain-text description (no heading) 16/17 🟢 94%
📊 BBD readme has shared responsibility table (✅/❌) 16/17 🟢 94%
🚫 No documentation_md output in backplane 17/17 🟢 100%
🔄 meshstack_platform has lifecycle ignore_changes = [availability] 1/1 🟢 100%
🗒️ Building block renders a summary 16/17 🟢 94%
🪪 Trusts the runner's identity, not the replicator's 6/6 🟢 100%
AWS Backplane — not applicable

AWS automation principal conventions (WIF or cross-account StackSet) — applies to 0 modules

No applicable modules.

Azure Backplane — not applicable

Azure UAMI-based automation principal conventions — applies to 0 modules

No applicable modules.

GCP Backplane — not applicable

GCP workload-identity-federation automation principal conventions — applies to 0 modules

No applicable modules.

STACKIT Backplane — ✅ all passing

STACKIT WIF-based automation principal conventions — applies to 6 modules

Module Score 🔐 🚫 📤 ⚡
stackit/network 🟢 100% ✅ ✅ ✅ ✅
stackit/network-area 🟢 100% ✅ ✅ ✅ ✅
stackit/project 🟢 100% ✅ ✅ ✅ ✅
stackit/server 🟢 100% ✅ ✅ ✅ ✅
stackit/service-account 🟢 100% ✅ ✅ ✅ ✅
stackit/service-account-federation 🟢 100% ✅ ✅ ✅ ✅

STACKIT Backplane — Summary

Emoji Criterion Coverage Status
🔐 Uses stackit_service_account_federated_identity_provider 6/6 🟢 100%
🚫 No stackit_service_account_key resource 6/6 🟢 100%
📤 Outputs service_account_email (not key) 6/6 🟢 100%
⚡ WIF auth via env vars, not provider arguments 6/6 🟢 100%
Shared Practices — some checks failing

Practices modules and reference architectures share — applies to 17 modules

Module Score 🎯 🔐 🫥 🧾 🔢 🪞
kubernetes/ingress 🔴 40% ✅ ✅ ❌ ❌ ➖ ❌
kubernetes/manifest 🟢 100% ✅ ✅ ➖ ➖ ➖ ➖
kubernetes/service-account 🔴 40% ✅ ✅ ❌ ❌ ➖ ❌
ske/cluster 🔴 40% ✅ ✅ ❌ ❌ ➖ ❌
ske/forgejo-connector 🟡 50% ✅ ✅ ❌ ➖ ➖ ❌
stackit/ai-llm 🟡 60% ✅ ✅ ❌ ❌ ➖ ✅
stackit/container-registry 🔴 40% ✅ ✅ ❌ ❌ ➖ ❌
stackit/dns 🟡 50% ✅ ✅ ➖ ❌ ➖ ❌
stackit/git 🔴 40% ✅ ✅ ❌ ❌ ➖ ❌
stackit/git-runner 🟡 50% ✅ ✅ ❌ ➖ ➖ ❌
stackit/network 🟡 75% ❌ ✅ ➖ ✅ ➖ ✅
stackit/network-area 🟡 75% ✅ ✅ ➖ ❌ ➖ ✅
stackit/project 🟡 67% ✅ ✅ ➖ ➖ ➖ ❌
stackit/server 🔴 25% ❌ ❌ ➖ ✅ ➖ ❌
stackit/service-account 🟡 75% ❌ ✅ ➖ ✅ ➖ ✅
stackit/service-account-federation 🟢 100% ✅ ✅ ➖ ✅ ➖ ✅
stackit/stackit-project-starterkit 🟢 100% ✅ ✅ ➖ ➖ ➖ ➖

Shared Practices — Summary

Emoji Criterion Coverage Status
🎯 meshStack *_ref attributes take a ref, never an object built from a uuid 14/17 🟢 82%
🔐 no building block output carries a secret 16/17 🟢 94%
🫥 Sensitive building block variables are ephemeral 0/8 🔴 0%
🧾 User-facing BBD inputs backed by an object or map variable are JSON with a json_schema 4/12 🔴 33%
🔢 BBD inputs and their variables are declared in display order n/a —
🪞 The definition owns input defaults: variables fed by required inputs have no default and are not nullable, no "" as unset 5/15 🔴 33%
Testing — some checks failing

End-to-end test coverage — applies to 17 modules

Module Score ⚙️ 🧪 🚫 🎭 ✅
kubernetes/ingress 🔴 33% ➖ ❌ ✅ ➖ ❌
kubernetes/manifest 🟡 50% ✅ ❌ ✅ ➖ ❌
kubernetes/service-account 🔴 33% ➖ ❌ ✅ ➖ ❌
ske/cluster 🔴 25% ❌ ❌ ✅ ➖ ❌
ske/forgejo-connector 🟡 50% ❌ ➖ ✅ ➖ ➖
stackit/ai-llm 🔴 25% ❌ ❌ ✅ ➖ ❌
stackit/container-registry 🔴 25% ❌ ❌ ✅ ➖ ❌
stackit/dns 🔴 25% ❌ ❌ ✅ ➖ ❌
stackit/git 🔴 25% ❌ ❌ ✅ ➖ ❌
stackit/git-runner 🔴 25% ❌ ❌ ✅ ➖ ❌
stackit/network 🟢 100% ✅ ✅ ✅ ✅ ✅
stackit/network-area 🟢 100% ✅ ✅ ✅ ✅ ✅
stackit/project 🟢 100% ✅ ✅ ✅ ✅ ✅
stackit/server 🟢 100% ✅ ✅ ✅ ✅ ✅
stackit/service-account 🟢 100% ✅ ✅ ✅ ✅ ✅
stackit/service-account-federation 🟢 100% ✅ ✅ ✅ ✅ ✅
stackit/stackit-project-starterkit 🔴 33% ➖ ❌ ✅ ➖ ❌

Testing — Summary

Emoji Criterion Coverage Status
⚙️ backplane/ directory (optional tier) 7/14 🟡 50%
🧪 e2e/ test directory exists 6/16 🔴 38%
🚫 no .tftest.hcl outside e2e/ 17/17 🟢 100%
🎭 every .tftest.hcl runs against real infrastructure 6/6 🟢 100%
✅ e2e/ contains .tftest.hcl files 6/16 🔴 38%

📈 Overall Summary

Overall Average Score: 88%

Score Distribution

  • 🟢 High maturity (≥80%): 16 modules
  • 🟡 Medium maturity (50–79%): 1 modules
  • 🔴 Low maturity (<50%): 0 modules

📊 meshstack-hub Reference Architecture Scorecard

Generated: 2026-11-06 | Reference Architectures scanned: 2 | Categories: 3

📋 Per-Reference Architecture Category Summary

Score per category per reference architecture. n/a = category does not apply to this reference architecture.
Included modules are scored by the module scorecard, and only summarized here.

Reference Architecture Overall Shared Practices Reference Architecture Testing Included modules
stackit-kubernetes 🟢 83% 🟡 60% 🟢 100% 🟢 100% 12 modules; 11 with failures: kubernetes/ingress 84%, ske/cluster 81%, ske/forgejo-connector 89%, ske/ske-starterkit 94%, stackit/ai-llm 84%, stackit/container-registry 81%, stackit/dns 83%, stackit/git 78%, stackit/git-repository 94%, stackit/secrets-manager 92%, stackit/service-account 97%; not scored: modules/kubernetes
stackit-landingzone 🟡 75% 🟢 83% 🟡 75% 🟡 50% 6 modules; 5 with failures: stackit/network 97%, stackit/network-area 97%, stackit/project 86%, stackit/service-account 97%, stackit/stackit-project-starterkit 93%; not scored: modules/stackit

⚠️ 2 reference architectures have failing checks — failing categories are expanded below.

Shared Practices — some checks failing

Practices modules and reference architectures share — applies to 2 reference architectures

Reference Architecture Score 🎯 🔐 🫥 🧾 🔢 🪞
stackit-kubernetes 🟡 60% ❌ ✅ ➖ ❌ ✅ ✅
stackit-landingzone 🟢 83% ❌ ✅ ✅ ✅ ✅ ✅

Shared Practices — Summary

Emoji Criterion Coverage Status
🎯 meshStack *_ref attributes take a ref, never an object built from a uuid 0/2 🔴 0%
🔐 no building block output carries a secret 2/2 🟢 100%
🫥 Sensitive building block variables are ephemeral 1/1 🟢 100%
🧾 User-facing BBD inputs backed by an object or map variable are JSON with a json_schema 1/2 🟡 50%
🔢 BBD inputs and their variables are declared in display order 2/2 🟢 100%
🪞 The definition owns input defaults: variables fed by required inputs have no default and are not nullable, no "" as unset 2/2 🟢 100%
Reference Architecture — some checks failing

How a reference architecture orders and documents its building blocks — applies to 2 reference architectures

Reference Architecture Score 🆕 📌 🛂 🗺️
stackit-kubernetes 🟢 100% ✅ ✅ ✅ ✅
stackit-landingzone 🟡 75% ❌ ✅ ✅ ✅

Reference Architecture — Summary

Emoji Criterion Coverage Status
🆕 Children are ordered with, and outputs hand out, version_latest 1/2 🟡 50%
📌 Hub sources, ref_name and assets follow var.hub.git_ref 2/2 🟢 100%
🛂 The definition takes its approval policies from a variable 2/2 🟢 100%
🗺️ README.md shows a committed diagram (.dot + .svg) 2/2 🟢 100%
Testing — some checks failing

End-to-end test coverage — applies to 2 reference architectures

Reference Architecture Score 🚫 🎭 🧪
stackit-kubernetes 🟢 100% ✅ ✅ ✅
stackit-landingzone 🟡 50% ✅ ➖ ❌

Testing — Summary

Emoji Criterion Coverage Status
🚫 no .tftest.hcl outside e2e/ 2/2 🟢 100%
🎭 every .tftest.hcl runs against real infrastructure 1/1 🟢 100%
🧪 e2e/main.tf with a .tftest.hcl 1/2 🟡 50%

📈 Overall Summary

Overall Average Score: 79%

Score Distribution

  • 🟢 High maturity (≥80%): 1 reference architectures
  • 🟡 Medium maturity (50–79%): 1 reference architectures
  • 🔴 Low maturity (<50%): 0 reference architectures

@aws-amplify-eu-central-1

aws-amplify-eu-central-1 Bot commented Nov 6, 2026

Copy link
Copy Markdown

This pull request is automatically being deployed by Amplify Hosting (learn more).

Access this pull request here: https://pr-433.d1o16zfeoh2slu.amplifyapp.com

@grubmeshi
grubmeshi marked this pull request as ready for review November 6, 2026 14:45
@grubmeshi
grubmeshi requested a review from henryde November 6, 2026 14:45
grubmeshi and others added 26 commits November 6, 2026 15:46
@grubmeshi @claude
feat(ref-arch/stackit-kubernetes): add a summary to the cluster, Git,…
c7f6d9a 
… ingress, connector and service account blocks

The SKE Cluster, STACKIT Git Instance, Kubernetes Ingress, SKE Forgejo Connector and Kubernetes
Service Account definitions declare a `summary` output. Each shows names, links into the STACKIT
portal or Forgejo, and the Vault paths of the secrets it writes or reads.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@grubmeshi @claude
docs(ref-arch/stackit-kubernetes): explain how the starter kit reache…
1a07877 
…s application teams

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@grubmeshi @claude
fix(ske/cluster): link the summary to the cluster's portal page
6cb4906 
The old link opened a portal path that does not exist. The summary now builds the cluster's
overview URL itself, and the cluster_url output goes away because nothing else used it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@grubmeshi @claude
feat(ref-arch/stackit-kubernetes): open the summary links in a new tab
db1c493 
meshPanel opens a Markdown link in the same tab, so the links in the cluster, Git and connector
summaries are HTML anchors with target="_blank".

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@grubmeshi @claude
feat(scorecard): check that a building block renders a summary with n…
60e62ef 
…ew-tab links

summary_output fails a Terraform module whose integration declares no SUMMARY output or whose
buildingblock/ has no `summary` output. summary_links_new_tab fails a summary that holds a Markdown
link or an anchor without target="_blank" and rel="noopener". terraform-conventions.md documents
both, and the module skill points at it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@grubmeshi @claude
fix(scorecard): give the summary checks emojis no other check uses
557b9ff 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@grubmeshi @claude
fix(ref-arch/stackit-kubernetes): write the summary links as Markdown…
7073022 
… links again

Summaries hold no HTML anchors, so the cluster, Git and connector summaries go back to plain
Markdown links. The cluster's portal link stays.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@grubmeshi @claude
refactor(scorecard): drop the check that summary links open in a new tab
a6acfe3 
summary_output stays. Summaries use plain Markdown links, so terraform-conventions.md no longer
asks for HTML anchors.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@grubmeshi @claude
feat(stackit/git-runner): add a summary to the building block
a4ad833 
The summary links the organization and its runners page, and lists the labels, the runner version,
the server and the egress IP.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@grubmeshi @claude
feat(ref-arch/stackit-landingzone): put the whole Kubernetes platform…
12fcb28 
… tip inside the tip block

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@grubmeshi @claude
feat(ref-arch/stackit-landingzone): explain the default landing zone …
bdd6919 
…variant in the tip

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@grubmeshi @claude
fix(stackit): link the portal pages of DNS zones, service accounts an…
b443a54 
…d projects

The DNS zone link and the service accounts list used `/projects/<id>/…` paths that the portal no
longer opens. Each link now goes to the resource's own overview page, and project links use the
dashboard URL the portal redirects to.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@grubmeshi @claude
fix(kubernetes/service-account): return the kubeconfig output as plai…
7577801 
…n text

meshStack has no sensitive outputs, so the OpenTofu sensitive flag only hid what the building block
shows anyway. The comment points to output_to_vault, and the output stays "" there because
meshStack fails a run whose declared output is missing.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@grubmeshi @claude
docs(kubernetes/service-account): say in the kubeconfig description t…
b981c5f 
…hat it is sensitive

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@grubmeshi @claude
docs(kubernetes/service-account): move the kubeconfig warning to the …
f0c8cb5 
…definition output

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@grubmeshi @claude
docs(kubernetes): name STACKIT only as an example in the kubernetes m…
8148636 
…odules

The kubernetes modules run on any cluster, so comments, descriptions and readmes describe Vault
users and cluster definitions in general terms and mention STACKIT as one example.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@grubmeshi @claude
docs(kubernetes): rewrap the lines that named STACKIT
9c6febd 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@grubmeshi @claude
feat(ref-arch/stackit-kubernetes): name the building blocks and proje…
4fb2fa4 
…ct after the platform identifier

The outer building block is named "STACKIT Kubernetes Platform <id>" through the definition's
display_name_template, the nested one "STACKIT Kubernetes Platform Services <id>", and a fresh
meshProject "STACKIT Kubernetes Platform <id>", so several installs in one workspace can be told
apart. The provider renames the nested building block in place without a run.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@grubmeshi @claude
feat(ref-arch/stackit-landingzone): name the building block after the…
915d6e1 
… platform identifier

The definition's display_name_template names the building block "STACKIT Landing Zone <id>" in the
order form, so several landing zones in one workspace can be told apart.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@grubmeshi @claude
feat(ref-arch/stackit-kubernetes)!: rename an adopted project to the …
3181f26 
…standard name

imports.project no longer takes a display_name: an adopted meshProject is renamed to "STACKIT
Kubernetes Platform <id>" like a fresh one. Its identifier stays, so the rename happens in place.

BREAKING CHANGE: callers that pass imports.project.display_name must drop it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@grubmeshi @claude
test(ref-arch/stackit-kubernetes): name the e2e building block after …
a4fdc1b 
…the platform identifier

The run id stays in front, so the cleanup still finds the block.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@grubmeshi @claude
docs(ref-arch/stackit-kubernetes): show the demo app inside the names…
0f266dd 
…pace in the app-team diagram

Stages read as {dev,prod,…}, and the DNS zone no longer claims a wildcard hostname.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@grubmeshi @claude
docs(ref-arch/stackit-kubernetes): draw only building blocks and thei…
1c6436e 
…r parents in the tree

The tree showed Secrets Manager users, the meshStack platform and a definition as boxes, and
labelled edges with data flows. It now has one box per building block, unlabelled parent-to-child
arrows taken from the code, and frames for the run that orders them.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@grubmeshi @claude
docs(ref-arch/stackit-kubernetes): name the meshProject and meshTenan…
4511e37 
…t in the platform-team diagram

The STACKIT resources sit in the STACKIT Kubernetes Platform meshProject, whose STACKIT project is
a meshTenant on the landing zone's STACKIT meshPlatform. The BBD boxes lose their usage notes, and
the README text above both platform-team diagrams says how they relate.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@grubmeshi @claude
docs(ref-arch/stackit-kubernetes): drop the wildcard note from the pl…
316cfa7 
…atform-team diagram

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@grubmeshi @claude
fix(ske/cluster): bring back the Open Cluster button with the portal …
ec14e56 
…link

The summary and the RESOURCE_URL output share the cluster's portal URL.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
grubmeshi and others added 2 commits November 6, 2026 15:46
@grubmeshi @claude
feat(stackit): name the resource buttons "Open …" and add the missing…
87f4e88 
… ones

STACKIT Git gets "Open Forgejo" before "Open Forgejo Org", the service
account federation "Open Service Account", the Forgejo Connector "Open
Forgejo Actions" and the Git runner "Open Forgejo Runners". DNS, service
account, network and network area buttons are renamed to the same style.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@grubmeshi @claude
feat(stackit): link Git, Container Registry, server and AI token to t…
aa35ccb 
…he STACKIT portal

STACKIT Git and Container Registry get an "Open Portal" button after the
buttons of their own UI, the server "Open Server" and AI Model Serving
"Open Portal" on the token's page. The summaries link the same pages, and
the Container Registry summary links the Harbor repositories and robot
accounts.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@grubmeshi
grubmeshi removed the request for review from henryde November 6, 2026 14:46
@grubmeshi
grubmeshi force-pushed the feature/ske-ref-arch-followups branch from 0960097 to aa35ccb Compare November 6, 2026 14:47
@grubmeshi grubmeshi changed the title feat(ref-arch/stackit-kubernetes): summaries for the platform blocks, starter kit shipping docs feat(ref-arch/stackit-kubernetes)!: summaries, portal buttons and display names for the STACKIT platform Nov 6, 2026
@grubmeshi
grubmeshi merged commit aa35ccb into main Nov 6, 2026
4 of 5 checks passed
@grubmeshi
grubmeshi deleted the feature/ske-ref-arch-followups branch November 6, 2026 14:47
@sonarqubecloud

sonarqubecloud Bot commented Nov 6, 2026

Copy link
Copy Markdown

Quality Gate Passed Quality Gate passed

Issues
1 New issue
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@grubmeshi