pal-e-docs

Review: NetworkPolicy: allow pal-enterprises -> Postgres + Keycloak

review-1183-2026-05-09 Review

review needs-refinement
Project

Verdict: NEEDS_REFINEMENT

Template Completeness

  • [x] Type
  • [x] Lineage
  • [x] Repo
  • [x] User Story
  • [x] Context
  • [x] File Targets
  • [x] Acceptance Criteria
  • [x] Test Expectations
  • [x] Constraints
  • [x] Checklist
  • [x] Related
All required sections present per template-issue-feature.

Traceability

  • [x] story:sso-gateway label — SSO gateway story
  • [x] story note verified — found in project-pal-enterprises user-stories section (row: sso-gateway, role: Authenticated user, metric: Single login grants access to all platform tools)
  • [x] arch:rails-app label — Rails app architecture component
  • [ ] arch note MISSING — [SCOPE] Create architecture note arch-rails-app for component rails-app. Note: this ticket actually modifies Terraform in pal-e-platform, not the Rails app itself. Consider whether arch:platform-infra would be more accurate.
  • [x] Forgejo issue — ldraney/pal-e-platform#357, open

File Targets

  • [x] terraform/network-policies.tf — verified: file exists (10KB), Postgres allowlist at lines 158-180 (netpol_postgres), Keycloak allowlist at lines 134-156 (netpol_keycloak). Pattern is clear: add from entry with namespaceSelector matching pal-enterprises. No existing reference to pal-enterprises in the file.

Repo Placement

Correct. Issue filed on ldraney/pal-e-platform, file target is terraform/network-policies.tf in that repo.

Dependencies

No items in in_progress or next_up on board-pal-enterprises. Related infra items on the board:
  • #1184 — Kustomize overlay (backlog, independent)
  • #1185 — Woodpecker CI pipeline (backlog, independent)
Constraint documented: must be merged before first prod deploy. No blocking dependencies.

Acceptance Criteria

3 criteria, all verifiable by an agent:
  • pal-enterprises namespace in Postgres NetworkPolicy — verifiable by reading diff
  • pal-enterprises namespace in Keycloak NetworkPolicy — verifiable by reading diff
  • tofu plan -lock=false shows clean diff — valid command, but requires cluster access. Agent can verify the HCL syntax is correct; live plan requires infra credentials.

Blast Radius

Additive-only change. Existing pattern shows other services already in both allowlists (e.g., basketball-api in both Postgres and Keycloak, westside-ai-assistant in Keycloak). No downstream consumers affected. No risk of breaking existing policies.

Decomposition Assessment

1 file target, 1 repo, 3 acceptance criteria. Estimated agent time well under 5 minutes. No decomposition needed.

Recommendation

  • [SCOPE] Create architecture note arch-rails-app for the Rails app component. This note is referenced by the arch:rails-app label on this and 8 other board items but does not exist in pal-e-docs.