added condition for deploying metabase resources

[ccampbell-fearless]

Related tickets

• cloud.gov resource reduction - Stage 1 #5566

Description of changes

• Added condition for deploying metabase in staging and prod only
• Tf state migration was done locally for staging and prod resources so that existing instances will not be replaced

[github-actions]

Terraform plan for meta

No changes. Your infrastructure matches the configuration.

No changes. Your infrastructure matches the configuration.

Terraform has compared your real infrastructure against your configuration
and found no differences, so no changes are needed.

📝 Plan generated in Pull Request Checks #934

[github-actions]

Terraform plan for dev

Plan: 1 to add, 0 to change, 4 to destroy.

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
-   destroy
-/+ destroy and then create replacement

Terraform will perform the following actions:

  # module.dev.module.cors.null_resource.cors_header must be replaced
-/+ resource "null_resource" "cors_header" {
!~      id       = "*******************" -> (known after apply)
!~      triggers = { # forces replacement
!~          "always_run" = "2026-05-13T17:32:18Z" -> (known after apply)
        }
    }

  # module.dev.module.metabase-app.cloudfoundry_app.metabase will be destroyed
  # (because module.dev.module.metabase-app is not in configuration)
-   resource "cloudfoundry_app" "metabase" {
-       command                     = <<-EOT
            MB_DB_CONNECTION_URI=$(echo "$VCAP_SERVICES" | grep -o '"uri":\s*"[^"]*' | sed 's/"uri":\s*//' | cut -d '"' -f2 | tail -1)
            export MB_DB_CONNECTION_URI
            
            ./app/run_metabase.sh
        EOT -> null
-       created_at                  = "2026-03-27T12:54:01Z" -> null
-       disk_quota                  = "3072M" -> null
-       docker_image                = "metabase/metabase@sha256:80fdf179262eb4bc6e620eb2f90e1781b7d4ebb96e9ec45d974ca57675ed5003" -> null
-       enable_ssh                  = false -> null
-       environment                 = {
-           "ENV"                = "dev"
-           "REQUESTS_CA_BUNDLE" = "/etc/ssl/certs/ca-certificates.crt"
-           "SSL_CERT_FILE"      = "/etc/ssl/certs/ca-certificates.crt"
        } -> null
-       health_check_http_endpoint  = "/api/health" -> null
-       health_check_type           = "http" -> null
-       id                          = "e635c2bf-ddb1-48fa-a1eb-f9f5953c124b" -> null
-       instances                   = 1 -> null
-       log_rate_limit_per_second   = "-1" -> null
-       memory                      = "2048M" -> null
-       name                        = "metabase" -> null
-       org_name                    = "gsa-tts-oros-fac" -> null
-       readiness_health_check_type = "process" -> null
-       routes                      = [
-           {
-               protocol = "http1" -> null
-               route    = "metabase-dev.app.cloud.gov" -> null
            },
        ] -> null
-       service_bindings            = [
-           {
-               params           = jsonencode({})
-               service_instance = "fac-db" -> null
            },
-           {
-               params           = jsonencode({})
-               service_instance = "https-proxy-creds" -> null
            },
-           {
-               params           = jsonencode({})
-               service_instance = "metabase-db" -> null
            },
        ] -> null
-       space_name                  = "dev" -> null
-       stack                       = "" -> null
-       strategy                    = "rolling" -> null
-       updated_at                  = "2026-03-27T12:54:09Z" -> null
    }

  # module.dev.module.metabase-app.cloudfoundry_route.app_route will be destroyed
  # (because module.dev.module.metabase-app is not in configuration)
-   resource "cloudfoundry_route" "app_route" {
-       created_at   = "2026-03-27T12:54:09Z" -> null
-       destinations = [
-           {
-               app_id           = "e635c2bf-ddb1-48fa-a1eb-f9f5953c124b" -> null
-               app_process_type = "web" -> null
-               id               = "114339f9-d460-4dab-a558-ac963db8eae3" -> null
-               port             = 3000 -> null
-               protocol         = "http1" -> null
            },
        ] -> null
-       domain       = "50ba3f69-cd54-4963-9172-14f3334b479e" -> null
-       host         = "metabase-dev" -> null
-       id           = "8439a08e-9611-46ed-98f6-0609d960e18d" -> null
-       protocol     = "http" -> null
-       space        = "06525ba3-19c2-451b-96e9-ea4a9134e8b9" -> null
-       updated_at   = "2026-03-27T12:54:09Z" -> null
-       url          = "metabase-dev.app.cloud.gov" -> null
    }

  # module.dev.module.metabasedb.cloudfoundry_service_instance.rds[0] will be destroyed
  # (because module.dev.module.metabasedb is not in configuration)
-   resource "cloudfoundry_service_instance" "rds" {
-       created_at        = "2026-03-27T12:43:52Z" -> null
-       id                = "da9f076b-0958-4be7-bc9d-594897f7f31c" -> null
-       last_operation    = {
-           created_at  = "2026-03-27T12:53:59Z" -> null
-           description = "Finished creating database resources" -> null
-           state       = "succeeded" -> null
-           type        = "create" -> null
-           updated_at  = "2026-03-27T12:53:59Z" -> null
        } -> null
-       maintenance_info  = {} -> null
-       name              = "metabase-db" -> null
-       parameters        = (sensitive value) -> null
-       service_plan      = "815c6069-289a-4444-ba99-40f0fa03a8f5" -> null
-       space             = "06525ba3-19c2-451b-96e9-ea4a9134e8b9" -> null
-       tags              = [
-           "rds",
-           "terraform-cloudgov-managed",
        ] -> null
-       type              = "managed" -> null
-       updated_at        = "2026-03-27T12:43:56Z" -> null
-       upgrade_available = false -> null
    }

Plan: 1 to add, 0 to change, 4 to destroy.

📝 Plan generated in Pull Request Checks #934

[daryll]

lgtm