fix(dbaas): repair the otel metrics example for provider 0.117.0

AGENTS.md

@@ -102,8 +102,8 @@ Fetch only the files relevant to the task. A typical example contains
   A collection of STACKIT Application Load Balancer (ALB) showcases with different TLS strategies — from self-signed to Let's Encrypt, from a single VM to Kubernetes
 - **`cdn-s3-static-website`** `[cdn, s3, object-storage, static-website, waf]`  
   A reference implementation showing how to deploy a static website using [STACKIT CDN](https://stackit.com/en/products/network/stackit-cdn) with [STACKIT Object Storage](http://stackit.com/en/products/storage/stackit-object-storage) as the origin
-- **`dbaas-otel-collect-metrics`** `[dbaas, postgresql, mongodb, otel, observability, metrics, monitoring]`  
-  Collect metrics from STACKIT PostgreSQL Flex and MongoDB instances using OpenTelemetry (OTel) and export them to STACKIT Observability
+- **`dbaas-otel-collect-metrics`** `[dbaas, postgresql, otel, observability, metrics, monitoring]`  
+  Collect metrics from STACKIT PostgreSQL Flex instances using OpenTelemetry (OTel) and export them to STACKIT Observability
 - **`dbaas-postgresql-kms-encryption`** `[dbaas, postgresql, kms, encryption, backup, key-management]`  
   Deploys a STACKIT PostgreSQL Flex instance whose volume **and backup storage** are encrypted with a customer-managed key from [STACKIT KMS](https://docs.stackit.cloud/products/security/kms/), together with the keyring, the key and the service account the database service uses to unwrap that key
 - **`iaas-cross-az-layer4-loadbalancer`** `[iaas, load-balancer, layer4, ha, networking, cross-az]`  

examples/dbaas-otel-collect-metrics/010-provider.tf

@@ -15,41 +15,45 @@
 # This file defines the required Terraform providers and their configurations.
 # It sets up the STACKIT, Kubernetes, and Helm providers to manage resources in the project and the SKE cluster.
 terraform {
-  required_version = ">= 0.14.0"
+  required_version = ">= 1.10.0"
   required_providers {
     stackit = {
       source  = "stackitcloud/stackit"
-      version = ">= 0.87.0"
-    }
-    random = {
-      source  = "hashicorp/random"
-      version = ">= 3.6.3"
+      version = ">= 0.117.0"
     }
     kubernetes = {
       source  = "hashicorp/kubernetes"
       version = ">=2.14.0"
     }
+    helm = {
+      source  = "hashicorp/helm"
+      version = ">= 3.1.1"
+    }
+    time = {
+      source  = "hashicorp/time"
+      version = ">= 0.13.1"
+    }
   }
 }
 
 provider "stackit" {
   default_region           = var.stackit_region
   service_account_key_path = var.stackit_service_account_key_path
-  experiments              = ["iam"]
+  experiments              = ["iam", "ske"]
 }
 
 provider "kubernetes" {
-  host                   = yamldecode(stackit_ske_kubeconfig.this.kube_config).clusters.0.cluster.server
-  client_certificate     = base64decode(yamldecode(stackit_ske_kubeconfig.this.kube_config).users.0.user.client-certificate-data)
-  client_key             = base64decode(yamldecode(stackit_ske_kubeconfig.this.kube_config).users.0.user.client-key-data)
-  cluster_ca_certificate = base64decode(yamldecode(stackit_ske_kubeconfig.this.kube_config).clusters.0.cluster.certificate-authority-data)
+  host                   = yamldecode(ephemeral.stackit_ske_kubeconfig.this.kube_config).clusters.0.cluster.server
+  client_certificate     = base64decode(yamldecode(ephemeral.stackit_ske_kubeconfig.this.kube_config).users.0.user.client-certificate-data)
+  client_key             = base64decode(yamldecode(ephemeral.stackit_ske_kubeconfig.this.kube_config).users.0.user.client-key-data)
+  cluster_ca_certificate = base64decode(yamldecode(ephemeral.stackit_ske_kubeconfig.this.kube_config).clusters.0.cluster.certificate-authority-data)
 }
 
 provider "helm" {
   kubernetes = {
-    host                   = yamldecode(stackit_ske_kubeconfig.this.kube_config).clusters.0.cluster.server
-    client_certificate     = base64decode(yamldecode(stackit_ske_kubeconfig.this.kube_config).users.0.user.client-certificate-data)
-    client_key             = base64decode(yamldecode(stackit_ske_kubeconfig.this.kube_config).users.0.user.client-key-data)
-    cluster_ca_certificate = base64decode(yamldecode(stackit_ske_kubeconfig.this.kube_config).clusters.0.cluster.certificate-authority-data)
+    host                   = yamldecode(ephemeral.stackit_ske_kubeconfig.this.kube_config).clusters.0.cluster.server
+    client_certificate     = base64decode(yamldecode(ephemeral.stackit_ske_kubeconfig.this.kube_config).users.0.user.client-certificate-data)
+    client_key             = base64decode(yamldecode(ephemeral.stackit_ske_kubeconfig.this.kube_config).users.0.user.client-key-data)
+    cluster_ca_certificate = base64decode(yamldecode(ephemeral.stackit_ske_kubeconfig.this.kube_config).clusters.0.cluster.certificate-authority-data)
   }
 }

examples/dbaas-otel-collect-metrics/020-variables.tf

@@ -12,22 +12,36 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-variable "stackit_project_id" {
-  type    = string
-  default = "d75e6aab-b616-4b42-ae3b-aaf161ad626d"
+variable "stackit_parent_container_id" {
+  type        = string
+  description = "Container ID of the organization or folder the project is created in"
+}
+
+variable "stackit_admin_email" {
+  type        = string
+  description = "Email address that becomes the owner of the created project"
+}
+
+variable "project_name" {
+  type        = string
+  description = "Name of the project that holds the cluster, the database and the Observability instance"
+  default     = "dbaas-otel-metrics"
 }
 
 variable "stackit_region" {
-  type    = string
-  default = "eu01"
+  type        = string
+  description = "STACKIT region"
+  default     = "eu01"
 }
 
-variable "stackit_service_account_key_path" {
-  type    = string
-  default = "../../keys/stackit-sa.json"
+variable "observability_plan_name" {
+  type        = string
+  description = "Plan of the Observability instance, for example Observability-Starter-EU01 for a smaller one"
+  default     = "Observability-Large-EU01"
 }
 
-resource "stackit_key_pair" "admin_keypair" {
-  name       = "admin-keypair-12345"
-  public_key = chomp(file("~/.ssh/id_rsa.pub"))
+variable "stackit_service_account_key_path" {
+  type        = string
+  description = "Path to the service account key file. Unset falls back to the STACKIT_SERVICE_ACCOUNT_KEY_PATH environment variable, then to that entry in the credentials file ($HOME/.stackit/credentials.json, or STACKIT_CREDENTIALS_PATH)."
+  default     = null
 }

examples/dbaas-otel-collect-metrics/025-project.tf

@@ -0,0 +1,29 @@
+# Copyright 2026 Schwarz Digits Cloud GmbH & Co. KG
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+resource "stackit_resourcemanager_project" "this" {
+  parent_container_id = var.stackit_parent_container_id
+  name                = var.project_name
+  owner_email         = var.stackit_admin_email
+
+  # A new project needs either this label or a networkArea label. PUBLIC keeps
+  # the project outside a network area, so SKE creates the cluster network.
+  labels = {
+    scope = "PUBLIC"
+  }
+}
+
+locals {
+  project_id = stackit_resourcemanager_project.this.project_id
+}

examples/dbaas-otel-collect-metrics/030-ske.tf

@@ -12,36 +12,17 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-resource "stackit_ske_kubeconfig" "this" {
-  project_id   = var.stackit_project_id
-  cluster_name = stackit_ske_cluster.this.name
-  refresh      = true
-
-  depends_on = [stackit_ske_cluster.this]
-}
-
-data "stackit_ske_kubernetes_versions" "this" {
-  version_state = "SUPPORTED"
-}
-
-data "stackit_ske_machine_image_versions" "this" {
-  version_state = "SUPPORTED"
-}
-
-locals {
-  flatcar_supported_version = one(flatten([
-    for mi in data.stackit_ske_machine_image_versions.this.machine_images : [
-      for v in mi.versions :
-      v.version
-      if mi.name == "flatcar"
-    ]
-  ]))
+# The cluster ID condition defers the kubeconfig request until the cluster exists.
+ephemeral "stackit_ske_kubeconfig" "this" {
+  project_id   = local.project_id
+  cluster_name = stackit_ske_cluster.this.id != "" ? stackit_ske_cluster.this.name : ""
+  # Two hours cover a first apply in which the database finishes long after the cluster.
+  expiration = 7200
 }
 
 resource "stackit_ske_cluster" "this" {
-  project_id             = var.stackit_project_id
-  name                   = "dbaas-otel"
-  kubernetes_version_min = data.stackit_ske_kubernetes_versions.this.kubernetes_versions.0.version
+  project_id = local.project_id
+  name       = "dbaas-otel"
 
   node_pools = [
     {
@@ -50,8 +31,7 @@ resource "stackit_ske_cluster" "this" {
       minimum            = "3"
       maximum            = "9"
       max_surge          = "3"
-      availability_zones = ["eu01-1", "eu01-2", "eu01-3"]
-      os_version_min     = local.flatcar_supported_version
+      availability_zones = [for z in [1, 2, 3] : "${var.stackit_region}-${z}"]
       os_name            = "flatcar"
       volume_size        = 150
       volume_type        = "storage_premium_perf6"

examples/dbaas-otel-collect-metrics/040-observability.tf

@@ -13,8 +13,8 @@
 # limitations under the License.
 
 resource "stackit_observability_instance" "example" {
-  project_id   = var.stackit_project_id
+  project_id   = local.project_id
   name         = "example-obs"
-  plan_name    = "Observability-Large-EU01"
+  plan_name    = var.observability_plan_name
   alert_config = null
 }

examples/dbaas-otel-collect-metrics/050-postgres.tf

@@ -12,32 +12,35 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
+data "stackit_postgresflex_flavors" "this" {
+  project_id = local.project_id
+}
+
 resource "stackit_postgresflex_instance" "this" {
-  project_id      = var.stackit_project_id
+  project_id      = local.project_id
   name            = "example-instance"
-  backup_schedule = "00 00 * * *"
-  flavor = {
-    cpu = 2
-    ram = 4
-  }
-  replicas = 3
+  backup_schedule = "0 0 * * *"
+  retention_days  = 32
+  flavor_id       = one([for f in data.stackit_postgresflex_flavors.this.flavors : f.id if f.cpu == 2 && f.memory == 4 && f.node_type == "Replica"])
   storage = {
     class = "premium-perf2-stackit"
     size  = 15
   }
   version = 15
-  acl     = ["0.0.0.0/0"]
+  network = {
+    acl = ["0.0.0.0/0"]
+  }
 }
 
 resource "stackit_postgresflex_user" "this" {
-  project_id  = var.stackit_project_id
+  project_id  = local.project_id
   instance_id = stackit_postgresflex_instance.this.instance_id
   username    = "test"
   roles       = ["createdb", "login"]
 }
 
 resource "stackit_postgresflex_database" "this" {
-  project_id  = var.stackit_project_id
+  project_id  = local.project_id
   instance_id = stackit_postgresflex_instance.this.instance_id
   name        = "test"
   owner       = stackit_postgresflex_user.this.username

examples/dbaas-otel-collect-metrics/051-service-account.tf

@@ -14,25 +14,32 @@
 
 resource "stackit_service_account" "this" {
   name       = "prom-proxy"
-  project_id = var.stackit_project_id
+  project_id = local.project_id
 }
 
 resource "time_rotating" "rotate" {
   rotation_days = 150
 }
 
+# The service account API generates the private key, and Terraform stores it in
+# plain text in the state. This is only an example and should not be used this
+# way in production.
 resource "stackit_service_account_key" "this" {
-  project_id            = var.stackit_project_id
+  project_id            = local.project_id
   service_account_email = stackit_service_account.this.email
   ttl_days              = 180
 
   rotate_when_changed = {
     rotation = time_rotating.rotate.id
   }
+
+  lifecycle {
+    create_before_destroy = true
+  }
 }
 
 resource "stackit_authorization_project_role_assignment" "this" {
-  resource_id = var.stackit_project_id
+  resource_id = local.project_id
   role        = "prometheus-proxy.reader"
   subject     = stackit_service_account.this.email
 }