pal-e-docs

Review: Provision k8s secrets for notion-mcp-remote (re-review)

review-1047-2026-04-21-v2 Review

review ready
Project

Verdict: APPROVED

Re-review of board item #1047 / Forgejo issue forgejo_admin/notion-mcp-remote#7 after refinement. Prior verdict: review-1047-2026-04-21 NEEDS_REFINEMENT. All flagged gaps have been resolved. Type: Feature. Points: 2.

Refinement Gaps Closed

The prior review flagged a [BODY] gap: the AC secret name/shape did not match the deployment manifest on main. Verified against /home/ldraney/notion-mcp-remote/k8s/deployment.yaml:
  • [x] Secret name corrected to notion-mcp-secrets (matches manifest line 41, 46, 51, 56, 61)
  • [x] Keys rewritten in kebab-case: base-url, oauth-client-id, oauth-client-secret, session-secret, onboard-secret (matches manifest lines 42, 47, 52, 57, 62 exactly)
  • [x] Wiring model changed to valueFrom: secretKeyRef; envFrom language removed from Context
  • [x] Mapping table added: secret key → env var → consumer (matches manifest env block lines 38-62)
  • [x] AC strengthened: now requires kubectl rollout status, kubectl exec env verification of all 5 env vars inside the container, and a /health 200 probe
  • [x] Explicit constraint added: "Do not normalise to UPPER_SNAKE_CASE; secretKeyRef.key lookups are case-sensitive"

Template Completeness

  • [x] Type (Feature)
  • [x] Lineage
  • [x] Repo
  • [x] User Story (role / want / so-that)
  • [x] Context (now internally consistent with the deployment)
  • [x] File Targets (correctly "no repo file changes")
  • [x] Acceptance Criteria (7 items, each verifiable)
  • [x] Test Expectations (runnable kubectl commands)
  • [x] Constraints (4 guardrails including the new case-sensitivity callout)
  • [x] Checklist (5 items)
  • [x] Related (project, story, SOP, arch note)

Traceability

  • [x] story:ops-deploy-gitops label — GitOps Deploy via pal-e Platform
  • [x] story note verified — story-notion-mcp-remote-ops-deploy-gitops exists; AC row "Secrets provisioned via kubectl create secret generic before first ArgoCD sync" maps 1:1
  • [x] arch:k8s-secret label — architectural coverage present in arch-deployment-notion-mcp-remote and arch-secrets-pipeline. Prior review's optional [LABEL] suggestion was not actioned, but it was optional ("interpretable but inconsistent") — not a blocker.
  • [x] Forgejo issue — URL valid, #7 open, body well-formed

File Targets

No repo file changes — this is a kubectl operation. Cross-checked manifest for shape alignment:
  • [x] k8s/deployment.yaml lines 38-62 — verified all 5 env blocks use valueFrom.secretKeyRef.name: notion-mcp-secrets with the exact kebab-case keys the AC now lists. Env var names match server.py consumers.

Repo Placement

OK. Issue on forgejo_admin/notion-mcp-remote; downstream kustomize work on pal-e-deployments (#1044); namespace on pal-e-platform (#1045). Correctly scoped.

Dependencies

Unchanged from prior review and still adequately documented: blocks on #1046 (OAuth integration) for real client id/secret, and on #1045 (tofu apply) for the namespace. Blocks downstream #1044 (kustomize overlay) and #1043 (ArgoCD Application) per SOP.

Acceptance Criteria

Strengthened materially. Previously testable-but-shallow (jsonpath key check + secret presence). Now forces the pod to actually come up with the bound values: rollout status, in-container env verification, and /health 200. Because server.py fails loudly on missing required env, a green pod proves the secret shape matches the manifest — this is exactly the right end-to-end assertion for this ticket.

Blast Radius

Unchanged. First-time bootstrap — no token encryption collateral. No sibling services consume notion-mcp-secrets. Prior reviewer's optional nit about SESSION_SECRET rotation impact was not added to the body — not a blocker for first-time provisioning, but worth a follow-up doc note if this ticket triggers future rotation runbooks.

Decomposition Assessment

1 repo, 0 file targets, 7 AC items (still a single kubectl create + verification loop), <5 minutes of operator time. No decomposition needed.

Recommendation

No action needed. Ticket is ready to advance from backlog to todo.

Summary

All [BODY] gaps from the prior review are closed. Secret name, key casing, wiring model, and env-var mapping now exactly match k8s/deployment.yaml on main. The acceptance criteria have been hardened to verify actual pod startup rather than just secret existence, which is the correct bar for this ticket. Verdict: APPROVED.