pal-e-docs

Review: T1: Keycloak dev redirect + ArgoCD app

review-1200-2026-05-10 Review

review needs-refinement
Project

Verdict: NEEDS_REFINEMENT

Template Completeness

  • [x] Type -- "Infra" (maps to Task base template)
  • [x] Lineage -- "Plan: pal-enterprises infrastructure overhaul (Ticket 1 of 5)"
  • [x] Repo -- ldraney/pal-e-services
  • [x] User Story -- developer dev-environment auth flow
  • [x] Context -- clear motivation, references existing pattern
  • [x] File Targets -- terraform/k3s.tfvars with line references
  • [x] Acceptance Criteria -- 5 items, all concrete
  • [x] Test Expectations -- 2 items, verifiable
  • [x] Constraints -- 3 items, clear
  • [x] Related -- 3 references with context
  • [ ] Checklist -- MISSING (PR opened, tests pass, no unrelated changes)

Traceability

  • [x] story:infra-overhaul label -- present on board item
  • [ ] story note MISSING -- [SCOPE] "infra-overhaul" is not listed in project-pal-enterprises user-stories section. Only landing-page, sso-gateway, tool-dashboard, client-portal exist. Create user story entry on project-pal-enterprises.
  • [x] arch:keycloak label -- present on board item
  • [ ] arch note MISSING -- [SCOPE] No arch-keycloak note found in pal-e-docs. Create architecture note arch-keycloak for the Keycloak component.
  • [x] Forgejo issue -- https://forgejo.tail5b443a.ts.net/ldraney/pal-e-services/issues/75, open

File Targets

  • [x] terraform/k3s.tfvars -- file is gitignored (*.tfvars in .gitignore), which is correct for secrets. Structure verified via k3s.tfvars.example. The keycloak_clients variable type confirms valid_redirect_uris (list(string)) and web_origins (list(string)) fields exist.
  • [x] Line references (238-257) -- cannot verify exact lines from repo (gitignored), but the pattern is confirmed: westside-admin client in k3s.tfvars.example shows the established multi-URI pattern with both prod and dev redirect URIs.
Note: Since k3s.tfvars is not tracked in git, the agent will need local filesystem access to the pal-e-services terraform directory to make this change. This is an operational constraint, not a scope issue.

Repo Placement

OK. Issue is filed on ldraney/pal-e-services, which houses the terraform/ directory. The keycloak client config and ArgoCD app creation both live in this repo's terraform state. No cross-repo work needed.

Dependencies

  • Upstream (done): pal-e-deployments#156 (prod overlay) -- closed, already merged. This is a prerequisite for the ArgoCD app to have a source_path to point to.
  • Downstream: T2 (board item #1197, dev overlay) depends on Keycloak redirect being configured first, since the dev environment needs auth to work.
  • Related: T5 (board item #1199, Woodpecker CI / pal-enterprises#7) -- independent, no dependency.
  • Related: Board item #1192 (Keycloak upgrade to 26.x) -- shares arch:keycloak label but is independent work in pal-e-platform.
  • Not documented in scope: The ArgoCD app creation requires a services entry in k3s.tfvars (per services.tf pattern). The issue mentions ArgoCD app but does not list the services block as a file target. However, since k3s.tfvars is a single file, this is covered by the existing file target.

Acceptance Criteria

5 criteria, all concrete and agent-verifiable:
  • AC1-2: Verifiable by inspecting tfvars after edit
  • AC3: Verifiable by running tofu apply (requires local access)
  • AC4: Verifiable via kubectl command (provided in AC)
  • AC5: Verifiable via Keycloak admin console (requires browser/API access)
AC3 and AC5 require runtime access, not just code changes. This is expected for infra tickets.

Blast Radius

  • Test expectation #2 explicitly constrains: "No other Keycloak clients or services affected."
  • The tofu plan step (Test Expectation #1) will verify blast radius before apply.
  • The westside-admin pattern is well-established -- adding redirect URIs to an existing client is a safe, additive change.
  • The ArgoCD app creation is also additive -- it creates a new application entry, does not modify existing ones.
  • No downstream consumers affected beyond the pal-enterprises app itself.

Decomposition Assessment

1 file target, 1 repo, 5 AC, estimated agent work under 5 minutes. No decomposition needed.

Broken Reference

The issue's Related section references sop-keycloak-client-creation but this note does not exist in pal-e-docs. This is informational -- it does not block the ticket but the SOP should either be created or the reference removed.

Recommendations

  • [BODY] Add missing Checklist section (PR opened, tests pass, no unrelated changes)
  • [SCOPE] Create user story entry "infra-overhaul" on project-pal-enterprises user-stories section -- this story is used by 5 tickets (T1-T5) on this board
  • [SCOPE] Create architecture note arch-keycloak for the Keycloak component -- referenced by this ticket and board item #1192
  • [BODY] Fix or remove broken reference to sop-keycloak-client-creation in Related section