meshStack Self-Service Landing Zone

Architecture

Overview

The STACKIT Landing Zone Accelerator provisions the platform baseline as code. This reference architecture adds the layer above it: meshStack registers the STACKIT platform, its landing zones and a set of building block definitions, so application teams order STACKIT projects and routed networks themselves instead of filing a ticket with the platform team.

It is implemented as OpenTofu in the meshStack Hub and deployed once per workspace.

How the two parts compose

The Accelerator’s management module creates an automation service account, assigns it owner at organization scope, and stores its key in Secrets Manager. That is exactly the credential this reference architecture needs: it takes one STACKIT service account key with resource-manager.admin on the organization. So the two run together as one stack — deploy the Accelerator, read the automation key from Secrets Manager, and hand it to the meshStack landing zone.

What it provisions

• STACKIT platform and landing zones: The STACKIT Project platform is registered in meshStack together with its landing zones, wired to the service account that creates projects.
• Project building block: A stackit/project building block definition that application teams order to get a STACKIT project, with meshStack roles mapped to STACKIT project roles.
• Optional hub-and-spoke networking: A shared network area holding the IPv4 address plan, plus a tenant-level stackit/network building block. Each order draws its subnet from the shared plan, so two teams cannot collide on CIDR ranges.
• Self-service starterkit: A STACKIT Project Starterkit definition that composes the two building blocks above into one order. It is always registered, and the landing zones it offers are the ones the deployment actually created.
• Resource hierarchy: A dedicated resourcemanager folder that tenant projects are created in, and a foundation project for the landing zone’s own service account.

Leaving the network configuration unset deploys the sandbox foundation only, which is the smallest useful starting point.

What application teams get

• A working project from one order: The starterkit creates the project in the landing zone the team picked and applies the role assignments, so nobody has to order the pieces separately.
• A subnet without coordination: On the networked landing zone the same order adds a routed network inside that project, its CIDR range assigned from the shared address plan.
• Visible ownership: Every project and network has a named owning team, which is what cost allocation and policy reporting build on.

Shared responsibilities

Swipe sideways to see the whole table

Responsibility	Platform Team	Application Team
Provision the STACKIT platform baseline with the Accelerator	✅	❌
Register the platform, landing zones and building block definitions	✅	❌
Choose the shared address plan (when networking is enabled)	✅	❌
Request STACKIT projects through a landing zone	❌	✅
Order routed networks inside their own projects	❌	✅
Operate the workloads inside their projects	❌	✅

Reference

• Source: meshstack-hub on GitHub

External source hub.meshcloud.io meshStack Hub: reference architectures The STACKIT Landing Zone reference architecture and the building block definitions it registers, in the meshStack building block registry. Open external site Leads off the trail