pal-e-docs

Review: K8s prod manifests + secrets for ArgoCD deployment

review-1375-2026-06-06-r2 Review

review needs-refinement
Project

Verdict: NEEDS_REFINEMENT

Re-review of board item #1375 after major refinement. Previous issues (wrong repo, ingress conflict, wrong secret pattern, port mismatch) were all addressed. Two new issues found.

Template Completeness

  • [x] Type — Feature
  • [x] Lineage — Child of #40, depends on #41
  • [x] Repo — specifies forgejo_admin/pal-e-deployments
  • [x] User Story — present
  • [x] Context — thorough, includes platform pattern, existing resources, database, port
  • [x] File Targets — 6 files to create, exclusion list present
  • [x] Acceptance Criteria — 8 criteria
  • [x] Test Expectations — kustomize build, SOPS decrypt, ArgoCD sync, dry-run command
  • [x] Constraints — 5 constraints, all clear
  • [x] Checklist — present
  • [x] Related — 5 references
All required sections present and complete.

Traceability

  • [x] story:ci-pipeline label — maps conceptually to story:WS-S1 ("deploy platform changes via IaC so that infrastructure is reproducible and auditable") on project-westside-basketball
  • [x] story note verified — WS-S1 exists in project-westside-basketball user-stories section under Superadmin
  • [ ] arch:k8s label — no matching architecture note found in pal-e-docs — [SCOPE] Create architecture note arch-k8s for Kubernetes component
  • [x] Forgejo issue — ldraney/westside-ror#42, state: open

File Targets

  • [ ] overlays/westside-ror/prod/kustomization.yaml — ISSUE: file ALREADY EXISTS in pal-e-deployments. Current version references bases/standard, renames to westside-ror, sets port 3000, uses ruby:3.4-slim image (not Harbor). Ticket says "create" but should say "update" to add SOPS secret resources, Harbor image, ingress resources, and namespace
  • [ ] overlays/westside-ror/prod/deployment-patch.yaml — ISSUE: file ALREADY EXISTS. Current version has hostPath volume mount (/home/ldraney/westside-ror), inline apt-get/bundle install command, and envFrom secretRef to rails-env. Ticket says "create" but should say "replace" with proper prod pattern (initContainer, SOPS secret refs, security context, no hostPath)
  • [x] overlays/westside-ror/prod/ingress.yaml — does not exist yet, correct to create. Tailscale Funnel pattern confirmed from westsidekingsandqueens/prod/ingress.yaml
  • [x] overlays/westside-ror/prod/ingress-westsidekingsandqueens.yaml — does not exist yet, correct to create
  • [x] overlays/westside-ror/prod/secrets.enc.yaml — does not exist yet, correct to create. SOPS age pattern confirmed from westsidekingsandqueens/prod/harbor-creds.enc.yaml
  • [x] overlays/westside-ror/prod/harbor-creds.enc.yaml — does not exist yet, correct to create

Repo Placement

ISSUE: The issue body says Repo: forgejo_admin/pal-e-deployments but the actual Forgejo repo is ldraney/pal-e-deployments. The API confirms the repo owner is ldraney, not forgejo_admin. An agent following the ticket would fail to find the repo or open the PR against the wrong owner. The Constraints section and Checklist also reference forgejo_admin/pal-e-deployments.

Dependencies

  • #41 (Terraform service onboarding) — prerequisite, state: open. Creates namespace + ArgoCD app. Documented in issue.
  • #43 (Dockerfile + Woodpecker CI) — sibling, state: open. Updates Dockerfile to drop Thruster, expose port 3000, push Harbor images. Documented in issue.
  • #40 (Epic: CI/CD pipeline) — parent epic, state: open. Documented in issue.
  • #28 (Commit prod deployment manifests) — board item 1358, column: done. This is the ticket that created the existing prod overlay files. The overlap was noted in the previous review context but the current ticket body does not acknowledge that kustomization.yaml and deployment-patch.yaml already exist.
Dependencies are well-documented in the issue. The gap is that #28's output (existing prod files) is not acknowledged in the file targets.

Acceptance Criteria

8 criteria, all testable by an agent:
  • [x] Directory existence — verifiable
  • [x] kustomization.yaml references bases/standard — verifiable by file read
  • [x] deployment-patch.yaml has initContainer with db:prepare — verifiable by file read
  • [x] Both Tailscale Funnel ingresses — verifiable by file read
  • [x] SOPS secret with 6 keys — verifiable by sops --decrypt or by checking encrypted structure
  • [x] Harbor pull secret follows SOPS pattern — verifiable by file structure comparison
  • [x] Port 3000 — verifiable by grep
  • [x] kustomize build renders valid manifests — verifiable by running command
Criteria are clear and agent-verifiable. Note: AC does not mention removing the hostPath mount or the inline apt-get command from the existing deployment-patch.yaml, which are dev artifacts that must go.

Blast Radius

  • The westsidekingsandqueens/prod overlay still exists but its namespace was terraform-destroyed. The ticket correctly notes this overlay should NOT be touched. The westsidekingsandqueens Tailscale Funnel ingress being added to westside-ror's overlay is the right approach.
  • The existing kustomization.yaml removes imagePullSecrets and uses ruby:3.4-slim instead of Harbor. The new version will need Harbor image + imagePullSecrets. This is a significant change from the current prod state — the running pod will need to be rebuilt from a Harbor image (dependent on #43).
  • The existing deployment-patch.yaml has hostPath mounts to /home/ldraney/westside-ror — this only works on nodes with Lucas's home directory. Removing this is correct for prod.

Decomposition Assessment

6 file targets in 1 repo, 8 acceptance criteria. All files are in the same overlay directory and follow established patterns. Estimated agent work: ~5 minutes (pattern-match from landscaping-assistant + westsidekingsandqueens, create/update 6 files). Borderline but feasible in a single pass given strong pattern references. No decomposition needed.

Recommendations

  • [BODY] Fix repo owner: forgejo_admin/pal-e-deployments → ldraney/pal-e-deployments in Repo section, Constraints section, and Checklist. Three occurrences total.
  • [BODY] Fix file target language: kustomization.yaml and deployment-patch.yaml already exist (created by #28). Change "create" to "replace/update" for these two files and note that the existing dev-like prod overlay (hostPath mounts, inline apt-get, ruby:3.4-slim base) must be fully replaced with proper prod patterns (Harbor image, SOPS secrets, initContainer, security context).
  • [SCOPE] Create architecture note arch-k8s for the Kubernetes component in pal-e-docs. Non-blocking but needed for full traceability.