[grubmeshi]

Stacked on #425: the base is feature/ske-ref-arch-migration-lz-form. Draft until #425 merges.

The STACKIT Kubernetes Platform order form follows the rules #425 set for the STACKIT Landing Zone.

• Input order: platform identifier, playground mode, landing zone, DNS parent domain, DNS subdomain, ClusterIssuer email, phase 2 completed, stages, tags, approval policies, starterkit approval policies, landing zone variant, use global location, AI model, starterkit image name and template repository, project identifier, cluster name, payment method, quota definitions, imports, import secrets. Then the STATIC starterkit_add_random_name_suffix and platform_engineer_role_mapping, the generated workspace, creator and workspace members, and hub last. The order follows the playground draft tuned in meshPanel. The nested Platform Services definition has display orders too.
• Inputs in both meshstack_integration.tf files and the variables in both buildingblock/variables.tf are declared in display order.
• Input defaults: a buildingblock variable fed by an input has no default. Optional inputs are nullable and only null means unset: cluster_name and dns_subdomain no longer handle "".
• Playground mode is an order form input, off by default and not updateable. The terraform_data pin from feat(ref-arch)!: order forms of the STACKIT Landing Zone and Kubernetes Platform #425 fails a run that changes it after the order.
• Approval Policies and Starterkit Approval Policies are JSON order form inputs, all gates off by default. The approval_policies variable now sets only the gates of this definition.
• Tags and stages are JSON inputs built from {key, values} lists; stages are a list with a name. The buildingblock folds them back into maps, so the nested building block gets the same values as before.
• Quota definitions and imports are JSON with schemas whose titles are the keys.
• imports.ske = {} and imports.ingress = {} become imports.adopt_ske and imports.adopt_ingress.
• Imports and Import Secrets are hidden in playground mode (!input.playground_mode); meshStack accepts the condition.
• project_owner_tag_key is optional; null sets no owner tag, through to ske-starterkit.

Breaking:

• Callers send playground_mode, approval_policies and starterkit_approval_policies as building block inputs. The module variables playground_mode and starterkit_approval_policies are gone.
• Callers send tags and stages as lists, adopt_ske/adopt_ingress = true instead of ske/ingress = {}, and leave out project_owner_tag_key instead of sending "".
• Callers send every optional input explicitly, jsonencode(null) included.

Verified: tofu validate passes in the outer and nested directories. Scorecard: bbd_input_order and bbd_input_defaults pass. ICF's and LCF's ske/platform units plan 0 to add, 2 to change, 0 to destroy against this branch, only the definition and the building block inputs change. TCF plans the first creation.

🤖 Generated with Claude Code

[github-actions]

Scorecard Check

Scorecard run on commit 2531699026bd7fe6370d1eb90855ecbc5ceb2cb1 relative to origin/feature/ske-ref-arch-migration-lz-form

📊 meshstack-hub Reference Architecture Scorecard

Generated: 2026-11-04 | Reference Architectures scanned: 1 | Categories: 3

📋 Per-Reference Architecture Category Summary

Score per category per reference architecture. n/a = category does not apply to this reference architecture.
Included modules are scored by the module scorecard, and only summarized here.

Reference Architecture	Overall	Shared Practices	Reference Architecture	Testing	Included modules
stackit-kubernetes	🟡 77%	🟡 50%	🟢 100%	🟢 100%	12 modules; 12 with failures: kubernetes/ingress 83%, ske/cluster 79%, ske/forgejo-connector 89%, ske/ske-starterkit 97%, stackit/ai-llm 83%, stackit/container-registry 80%, stackit/dns 82%, stackit/git 77%, stackit/git-repository 93%, stackit/secrets-manager 92%, stackit/service-account 97%, stackit/service-account-federation 97%; not scored: modules/kubernetes

⚠️ 1 reference architecture has failing checks — failing categories are expanded below.

Shared Practices — some checks failing

Practices modules and reference architectures share — applies to 1 reference architectures

Reference Architecture	Score	🎯	🔐	🫥	🧾	🔢	🪞
stackit-kubernetes	🟡 50%	❌	✅	❌	❌	✅	✅

Shared Practices — Summary

Emoji	Criterion	Coverage	Status
🎯	meshStack *_ref attributes take a ref, never an object built from a uuid	0/1	🔴 0%
🔐	no building block output carries a secret	1/1	🟢 100%
🫥	Sensitive building block variables are ephemeral	0/1	🔴 0%
🧾	User-facing BBD inputs backed by an object or map variable are JSON with a json_schema	0/1	🔴 0%
🔢	BBD inputs and their variables are declared in display order	1/1	🟢 100%
🪞	The definition owns input defaults: fed variables have none, optional inputs are nullable, no "" as unset	1/1	🟢 100%

Reference Architecture — ✅ all passing

How a reference architecture orders and documents its building blocks — applies to 1 reference architectures

Reference Architecture	Score	🆕	📌	🛂	🗺️
stackit-kubernetes	🟢 100%	✅	✅	✅	✅

Reference Architecture — Summary

Emoji	Criterion	Coverage	Status
🆕	Children are ordered with, and outputs hand out, version_latest	1/1	🟢 100%
📌	Hub sources, ref_name and assets follow var.hub.git_ref	1/1	🟢 100%
🛂	The definition takes its approval policies from a variable	1/1	🟢 100%
🗺️	README.md shows a committed diagram (.dot + .svg)	1/1	🟢 100%

Testing — ✅ all passing

End-to-end test coverage — applies to 1 reference architectures

Reference Architecture	Score	🚫	🎭	🧪
stackit-kubernetes	🟢 100%	✅	✅	✅

Testing — Summary

Emoji	Criterion	Coverage	Status
🚫	no .tftest.hcl outside e2e/	1/1	🟢 100%
🎭	every .tftest.hcl runs against real infrastructure	1/1	🟢 100%
🧪	e2e/main.tf with a .tftest.hcl	1/1	🟢 100%

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[grubmeshi]

Merged into #425, which now carries these commits.