Phase 1a: CI Validation for pal-e-deployments

phase-mcd-tracker-1a-ci-validation Phase

phase

Project

Goal: Every kustomize overlay PR on pal-e-deployments is validated in CI before merge — kubectl kustomize + server-side dry-run.

Owner: Dev agent

Repo: forgejo_admin/pal-e-deployments

Depends on: None (can run in parallel with remaining Phase 1 work)

Scope

Add a .woodpecker.yaml to pal-e-deployments that runs on every PR:

Step 1: Static kustomize validation

Catches: broken YAML, missing base refs, invalid patch targets, missing resources.

Step 2: Server-side dry-run

Catches: invalid field names, CRD mismatches, schema violations. Requires CI kubeconfig access (use node IP 10.0.0.217:6443, not 127.0.0.1).

Step 3 (future scope): Ephemeral namespace validation

Create a temporary namespace, apply the overlay for real, run a smoke test (e.g., wait for pod ready), tear down. This validates secrets, image pulls, and runtime behavior — not just schema. Defer to a later phase — dry-run=server covers 90% of failures.

Implementation Notes

Woodpecker needs to be activated on pal-e-deployments (may already be — check)
CI kubeconfig: 10.0.0.217:6443 (not 127.0.0.1 — pipeline pods can't reach localhost)
CI needs a kubeconfig secret or service account token
Image: bitnami/kubectl:latest or bundle kubectl into a custom image
Only validate overlays that changed in the PR (optimization — use git diff --name-only)

pending