pal-e-docs

Review: K8s prod manifests + secrets for ArgoCD deployment

review-1375-2026-06-06 Review

review needs-refinement
Project

Verdict: NEEDS_REFINEMENT

Template Completeness

  • [x] Type — Feature
  • [x] Lineage — child of #40, depends on #41
  • [x] Repo — ldraney/westside-ror
  • [x] User Story
  • [x] Context
  • [x] File Targets
  • [x] Acceptance Criteria
  • [x] Test Expectations
  • [x] Constraints
  • [x] Checklist
  • [x] Related
All required feature template sections present.

Traceability

  • [x] story:ci-pipeline label — present on board item
  • [ ] story note MISSING — project-westside-ror note does not exist in pal-e-docs (404). [SCOPE] Create project page project-westside-ror with user-stories section including ci-pipeline.
  • [x] arch:k8s label — present on board item
  • [ ] arch note MISSING — search for arch-k8s returned zero results. [SCOPE] Create architecture note arch-k8s for the k8s manifest component.
  • [x] Forgejo issue — ldraney/westside-ror#42, state: open

File Targets

  • [ ] k8s/prod/deployment.yaml — ISSUE: Wrong repo. The platform pattern places production manifests in pal-e-deployments/overlays/westside-ror/prod/, not in the app repo. A westside-ror/overlays/westside-ror/dev/ overlay already exists in pal-e-deployments. The sibling service westsidekingsandqueens has its prod overlay at pal-e-deployments/overlays/westsidekingsandqueens/prod/. Some older services (pal-e-docs, basketball-api) still have in-repo k8s/ dirs, but the platform has converged on pal-e-deployments.
  • [ ] k8s/prod/service.yaml — ISSUE: Same — belongs in pal-e-deployments.
  • [ ] k8s/prod/ingress-westside-ror.yaml — ISSUE: Same repo problem. Additionally, file already exists functionally in k8s/dev.yaml (lines 131-148) as a combined manifest.
  • [ ] k8s/prod/ingress-westsidekingsandqueens.yaml — ISSUE: Wrong assumption. The westsidekingsandqueens Tailscale Funnel ingress belongs to the westside-app (westsidekingsandqueens) deployment, NOT to westside-ror. It already exists at pal-e-deployments/overlays/westsidekingsandqueens/prod/ingress.yaml pointing to the westside-app service. Creating a second ingress for the same hostname would conflict.
  • [ ] k8s/prod/kustomization.yaml — ISSUE: The platform pattern uses pal-e-deployments with bases/standard as a kustomize base (deployment, service, networkpolicy). Prod overlays reference ../../../bases/standard and apply patches. This file should be in pal-e-deployments.
  • [ ] k8s/prod/sealed-secret.yaml — ISSUE: Platform uses SOPS (age encryption), not sealed-secrets. See pal-e-deployments/overlays/westsidekingsandqueens/prod/harbor-creds.enc.yaml and westside-app/k8s/auth-secret.enc.yaml for the pattern. File should be rails-env.enc.yaml in the overlay.
  • [x] k8s/dev.yaml — verified exists, ticket correctly says not to touch it.

Repo Placement

MAJOR MISMATCH. The issue says repo is ldraney/westside-ror and all file targets are k8s/prod/* inside the app repo. However, the established platform pattern places production manifests in pal-e-deployments. The closed issue #28 ("Commit prod deployment manifests") was correctly filed against ldraney/pal-e-deployments. This ticket should either:
  • Target pal-e-deployments/overlays/westside-ror/prod/ as the file location (matching the pattern from westsidekingsandqueens/prod/), OR
  • Be filed on the pal-e-deployments repo if the team wants the Forgejo issue to live with the code it modifies.

Dependencies

  • #41 (Terraform onboarding) — documented as prerequisite, state: open. Creates namespace, Harbor project, and ArgoCD app via terraform. This ticket correctly depends on it.
  • #43 (Dockerfile + Woodpecker CI) — documented as related, state: open. Pushes images to Harbor that these manifests reference. The deployment manifest needs a valid Harbor image to pull.
  • #28 (Commit prod deployment manifests) — state: closed/done. This was the PREVIOUS attempt to commit prod manifests, filed against pal-e-deployments. Overlap with this ticket needs clarification — was #28 completed, partially done, or superseded?
  • #1358 board item — board item for #28 is in done column. If that work was completed, this ticket may be partially or fully redundant.

Acceptance Criteria

  • [x] k8s/prod/ directory contains all manifests — testable but wrong directory per platform pattern
  • [x] Deployment references Harbor image — testable, clear
  • [ ] Both Tailscale Funnel ingresses present — ISSUE: westsidekingsandqueens ingress belongs to the separate westside-app service, not westside-ror. Only westside-ror funnel should be created here.
  • [x] Secret manifest includes all env vars — testable, clear list provided
  • [ ] Secret management follows platform pattern — ticket says "SOPS, sealed-secrets, or external-secrets — match landscaping-assistant" but landscaping-assistant has NO k8s directory. The reference should be westsidekingsandqueens overlay in pal-e-deployments, which uses SOPS with age encryption.
  • [x] docker-entrypoint runs db:prepare — verified: bin/docker-entrypoint runs db:prepare when starting rails server
  • [x] Dev overlay untouched — clear, testable

Blast Radius

  • Ingress hostname conflict: Creating a westsidekingsandqueens ingress under westside-ror would conflict with the existing ingress in pal-e-deployments/overlays/westsidekingsandqueens/prod/ingress.yaml. Tailscale Funnel hostnames are unique per cluster.
  • Overlap with closed #28: If issue #28 already committed manifests to pal-e-deployments, creating a second set in the app repo creates drift and confusion about source of truth.
  • Dockerfile entrypoint port: The Dockerfile uses Thruster and EXPOSEs port 80 (not 3000). The deployment and service manifests need to match — either target port 80 or override the CMD.

Decomposition Assessment

6 file targets (would be ~4 after corrections), 7 acceptance criteria. However, all files are in a single directory and the work is straightforward manifest creation. With corrected scope (single repo, ~4 files), this fits in a single agent pass. No decomposition needed after scope fixes are applied.

Recommendation

  • [BODY] Fix repo: change from ldraney/westside-ror to ldraney/pal-e-deployments, or clarify that file targets are in pal-e-deployments/overlays/westside-ror/prod/.
  • [BODY] Fix file targets: rewrite all paths from k8s/prod/* to overlays/westside-ror/prod/* in pal-e-deployments.
  • [BODY] Remove ingress-westsidekingsandqueens.yaml target — that ingress belongs to the separate westsidekingsandqueens overlay and already exists.
  • [BODY] Fix secret pattern reference: change "match landscaping-assistant" to "match westsidekingsandqueens overlay in pal-e-deployments (SOPS with age encryption)". Use rails-env.enc.yaml naming.
  • [BODY] Add note about kustomize base: prod overlay should reference ../../../bases/standard and apply patches (matching westsidekingsandqueens/prod/kustomization.yaml pattern).
  • [BODY] Fix AC #3: remove "westsidekingsandqueens" from the Funnel ingress criterion — only westside-ror funnel is needed.
  • [BODY] Fix AC #5: specify SOPS with age, not "SOPS, sealed-secrets, or external-secrets".
  • [BODY] Add AC: verify container port matches Dockerfile (port 80 via Thruster, not 3000).
  • [BODY] Clarify relationship with closed #28 — is this a replacement, continuation, or does #28 need reopening?
  • [SCOPE] Create project page project-westside-ror with user-stories section including ci-pipeline story.
  • [SCOPE] Create architecture note arch-k8s for the k8s manifest component.