pal-e-docs

Review 3: feat: add overlays/notion-mcp-remote/prod kustomize overlay

review-1044-2026-04-21-v3 Review

review ready
Project

Verdict: APPROVED

Third review of board item #1044 (Forgejo forgejo_admin/pal-e-deployments#132) after micro-fix round addressing the two residuals from review-1044-2026-04-21-v2. Both fixes landed cleanly in the live issue body. Ticket is ready to advance from backlog.

Verification of Micro-Fixes

# Fix Requested (v2) Landed? Evidence in live issue body
1 <code>[BODY]</code> Remote-base URL <code>.git/k8s</code> → <code>.git//k8s</code> (blocker -- kustomize requires <code>//</code> separator) YES Context section now shows <code>https://forgejo.tail5b443a.ts.net/forgejo_admin/notion-mcp-remote.git//k8s?ref=main</code> inside a fenced code block. Double-slash verified by direct string search of the issue body.
2 <code>[BODY]</code> Drop AC #4 (Image Updater annotations in <code>kustomization.yaml</code>) -- annotations live on the ArgoCD Application, not the overlay YES AC list now has 6 checkboxes (down from 7): (1) <code>kubectl kustomize</code> renders clean, (2) <code>resources:</code> remote URL, (3) <code>images:</code> transformer with SHA-regex <code>newTag</code>, (4) no <code>stringData</code>/<code>data</code>, (5) no env/envFrom redefinition, (6) PR reviewed and merged. No mention of "annotations present in <code>kustomization.yaml</code>" anywhere in the AC section.

Refinement Side-Effect Check

Spot-checked that the micro-fix did not regress anything else:
  • File Targets still references "the pinned remote URL above" -- correct single-source-of-truth factoring, no stale URL left in that section.
  • Context "Base factoring decision" still present with correct rationale (remote-base, not bases/standard/).
  • Secrets subsection unchanged: base wires env via valueFrom: secretKeyRef: name: notion-mcp-secrets with kebab-case keys; overlay must not override.
  • Ingress subsection unchanged: Funnel provisioned by pal-e-services terraform, no ingress.yaml in overlay.
  • Sibling ticket reference forgejo_admin/notion-mcp-remote#7 (board item #1047) intact in Context and Related.
  • Related section still lists convention-kustomize-overlay, arch-deployment-notion-mcp-remote, project-notion-mcp-remote, service-onboarding-sop, story-notion-mcp-remote-ops-deploy-gitops.
  • Checklist still enforces SHA regex ^[0-9a-f]{7,40}$ (not latest).
  • Issue remains open; labels on the board item preserved: type:feature,story:ops-deploy-gitops,arch:kustomize-overlay.

Template Completeness

  • [x] Type (Feature)
  • [x] Lineage
  • [x] Repo
  • [x] User Story
  • [x] Context
  • [x] File Targets
  • [x] Acceptance Criteria (6 items)
  • [x] Test Expectations
  • [x] Constraints
  • [x] Checklist
  • [x] Related

Traceability

  • [x] story:ops-deploy-gitops label present; story entry exists on project-notion-mcp-remote user-stories
  • [x] arch:kustomize-overlay label present; backing doc convention-kustomize-overlay
  • [x] type:feature matches Type header
  • [x] Forgejo issue forgejo_admin/pal-e-deployments#132 open

File Targets

  • [x] overlays/notion-mcp-remote/prod/kustomization.yaml -- new file, parent path aligns with sibling overlays
  • [x] overlays/notion-mcp-remote/prod/deployment-patch.yaml -- new file, standard overlay pattern
  • [x] Remote base URL verified renderable: forgejo_admin/notion-mcp-remote.git//k8s?ref=main with correct // separator

Repo Placement

Correct. Overlay created in pal-e-deployments; no cross-repo scope creep.

Dependencies

  • Sibling #1047 (forgejo_admin/notion-mcp-remote#7) -- Secret notion-mcp-secrets, not blocking overlay merge
  • Downstream #1045 (pal-e-platform#296) -- ArgoCD Application
  • Downstream #1043 (pal-e-services#57) -- var.services entry with source_path = "overlays/notion-mcp-remote/prod"

Acceptance Criteria

All 6 AC now testable and unambiguous. Previous AC #4 ambiguity (annotations in overlay vs Application) is resolved by removal. Image Updater write-back is covered by AC #3's SHA-regex constraint on newTag, which is sufficient because Image Updater's write-back to kustomization requires only the images: entry and the SHA format -- the annotations that drive the write-back live on the ArgoCD Application (provisioned by ticket #1043 via pal-e-services terraform).

Blast Radius

Low. Overlay inert until #1045 (ArgoCD Application) points at it AND #1047 (Secret) exists. Rollback: git revert.

Decomposition Assessment

3 points, 2 files, 1 repo, 6 AC. Fits single agent pass (<5 min). No decomposition needed.

Recommendation

No action needed. Ticket is APPROVED.
  • Tag board item #1044 with review,ready.
  • Ticket eligible to advance backlog → todo per sop-board-workflow on next ops pass.