Repository navigation
Conversation
Adds a T Cloud Public (Open Telekom Cloud) landing zone modeled on stackit-landingzone: - modules/otc: registers a custom `OTC` platform, a default landing zone and the project building block definition. - modules/otc/project: backplane (IAM user + group with Security Administrator, optional federated SAML/OIDC identity provider) and a building block that creates `<region>_<project>`, one IAM group per meshStack role with its role assignments, and records the project's group membership as `mappings/<project>.json` in an OBS bucket. - reference-architectures/otc-landingzone: README, diagram and the orderable building block wiring it all together. Federated users get their groups from the identity provider's single shared mapping. Instead of every project editing that mapping, each project writes only its own membership object; an aggregator function in the backplane rebuilds the full mapping from all objects. WIP: the backplane does not yet create the mapping bucket and the FunctionGraph aggregator, and the integration still passes the old password/identity-provider inputs. Not yet run against a real domain. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Contributor
Scorecard Check
📊 meshstack-hub Module Scorecard
📋 Per-Module Category SummaryScore per category per building block.
Core Structure — ✅ all passingBasic module file structure and documentation — applies to 2 modules
Core Structure — Summary
Integration — ✅ all passingmeshstack_integration.tf conventions — applies to 2 modules
Integration — Summary
AWS Backplane — not applicableAWS automation principal conventions (WIF or cross-account StackSet) — applies to 0 modules No applicable modules. Azure Backplane — not applicableAzure UAMI-based automation principal conventions — applies to 0 modules No applicable modules. GCP Backplane — not applicableGCP workload-identity-federation automation principal conventions — applies to 0 modules No applicable modules. STACKIT Backplane — not applicableSTACKIT WIF-based automation principal conventions — applies to 0 modules No applicable modules. Testing — some checks failingEnd-to-end test coverage — applies to 2 modules
Testing — Summary
📈 Overall SummaryOverall Average Score: 93%Score Distribution
|
|
This pull request is automatically being deployed by Amplify Hosting (learn more). |
State the reasons inline instead of pointing at the STACKIT modules. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> docs(otc): drop references to other clouds from comments and readmes
florianow
force-pushed
the
feature/otc-landingzone
branch
from
October 8, 2026 13:21
02f7d3a to
d1a9644
Compare
The identity provider's single mapping is no longer written by the project building blocks. Each project records its group membership as `mappings/<project>.json` in an OBS bucket, and a new `otc/federation-mapping` building block runs a FunctionGraph function that rebuilds the whole mapping from all records, on every bucket event and hourly. The function acts as an agency, so it holds no key. The reference architecture now creates a management project as a meshStack tenant on the new platform and orders the federation mapping building block on it. The provider resolves its project when it is configured, so the function has to run in an apply of its own. Also: - backplane user authenticates with an access key instead of a password - providers set `tenant_name` to the region project; AK/SK requires one - the optional identity provider form has no defaults, so an untouched form no longer switches federation on - domain name examples use a placeholder and accept both name formats Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
…e identity provider - `tags.project` and `tags.project_owner_tag_key` are optional, so a landing zone ordered before the management project existed runs without its Tags being filled in again. - A chosen protocol without its required fields now fails validation with a message saying what to fill in or to clear the input, instead of a provider error. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Found in the first meshStack run: - The `OTC` platform type had to exist up front. `modules/otc` can now create it (`otc_platform_type_create`), and the reference architecture creates one per landing zone, `OTC-<IDENTIFIER>`, since a platform type name is unique across the meshStack instance. - An `all_projects` role assignment needs the domain ID as well. - The Tags form no longer requires the management project fields: meshStack validates a stored value against the current schema on every edit, which rejected landing zones ordered before. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Template directives inside a `<<-EOT` heredoc throw off its indentation stripping, which turned the role table and the sign-in note into an indented code block in meshPanel. Build those lines in locals instead. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
…on, delete it first - The run's meshStack token cannot be renewed, so a run that waits past its expiry fails and loses the tenant from its state. Only the federation mapping building block needs the replicated project, so only a landing zone with federation waits for it. - The management tenant depends on the whole platform integration, so a destroy deletes it, and runs the project building block's destroy, before the backplane user that destroy authenticates as is gone. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
meshPanel counts an empty array as a missing required value, and the `building_block` and `project` tag maps default to `[]`. The order form stayed disabled with no field marked until a tag was added to each. Nothing in the Tags form is required now, and the buildingblock variable defaults every map, so an empty form plans. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Found ordering a second landing zone into the same meshStack: - meshStack requires a platform type's display name to be unique too, not just its name. `modules/otc` takes it as `otc_platform_type_display_name`, and the reference architecture names it after the platform. - The Tags form preset `projectOwner` as the owner tag key, which fails the management project with `409 TagValidation` on an instance that has no such tag. It is empty by default now. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
…deration.dev TEMPORARY, revert before merging. federation.dev only accepts project identifiers ending in -dev, -prod or -qa. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
…rrectly Template directives inside the `<<-EOT` heredoc threw off its indentation stripping, which merged the table rows and the playground note in meshPanel. Build the conditional parts in locals instead. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Without an identity provider the landing zone works, but meshStack's project members never reach T Cloud Public. The summary now says so in a warning: manage users in the IAM console for the time being, register T Cloud Public in one of the identity providers the T Cloud blueprints cover, and fill in the Identity Provider input for the next run. Once one is connected, a tip names it and links the federation mapping building block instead. The text moves to SUMMARY.md.tftpl: it branches, and template directives inside a heredoc broke its indentation. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
…hout federation Without an identity provider, meshStack's project members never reached the project groups. The project building block now adds each member's existing IAM user to the group of their role. IAM usernames cannot contain an `@`, and the provider looks users up by name only, so a member's IAM user is the one named like the part of their email before the `@`. meshStack creates no users; a member without an IAM user fails the run, naming the user. With federation nothing changes: the identity provider's mapping puts users into the groups, and no local user is looked up. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
… users Compares running with and without an identity provider, says why the federation mapping function exists only with one, and why the landing zone federates virtual users rather than linking IAM users (IAM user SSO): that would bring back per-user maintenance in T Cloud Public, with no SCIM to automate it. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds a T Cloud Public (Open Telekom Cloud) landing zone modeled on stackit-landingzone:
OTCplatform, a default landing zone and the project building block definition.<region>_<project>, one IAM group per meshStack role with its role assignments, and records the project's group membership asmappings/<project>.jsonin an OBS bucket.Federated users get their groups from the identity provider's single shared mapping. Instead of every project editing that mapping, each project writes only its own membership object; an aggregator function in the backplane rebuilds the full mapping from all objects.
WIP: the backplane does not yet create the mapping bucket and the FunctionGraph aggregator, and the integration still passes the old password/identity-provider inputs. Not yet run against a real domain.