Review: K8s prod manifests + secrets for ArgoCD deployment (R3)

Verdict: APPROVED

Template Completeness

• [x] Type -- Feature
• [x] Lineage -- child of #40, depends on #41
• [x] Repo -- ldraney/pal-e-deployments (correct)
• [x] User Story -- present and clear
• [x] Context -- thorough explanation of why existing files must be rewritten, references PR #189/#28, describes platform pattern
• [x] File Targets -- present with correct rewrite/create distinction
• [x] Acceptance Criteria -- 10 criteria, all testable
• [x] Test Expectations -- includes kustomize build dry-run command
• [x] Constraints -- clear on target repo, patterns, SOPS, port
• [x] Checklist -- present
• [x] Related -- comprehensive cross-references

Traceability

• [x] story:ci-pipeline label -- present on board item
• [ ] story note NOT verified -- project-westside-ror note does not exist in pal-e-docs. [SCOPE] Create project page with user-stories section (acknowledged non-blocking in R1/R2)
• [x] arch:k8s label -- present on board item
• [ ] arch note NOT verified -- no arch-k8s note found in pal-e-docs. [SCOPE] Create architecture note arch-k8s (acknowledged non-blocking in R1/R2)
• [x] Forgejo issue -- ldraney/westside-ror#42, open

File Targets

• [x] overlays/westside-ror/prod/kustomization.yaml -- verified EXISTS in pal-e-deployments. Currently references bases/standard, uses ruby:3.4-slim image, removes imagePullSecrets. Correctly marked as "rewrite"
• [x] overlays/westside-ror/prod/deployment-patch.yaml -- verified EXISTS. Currently has hostPath mount, inline apt-get/bundle, envFrom secretRef. Correctly marked as "rewrite"
• [x] overlays/westside-ror/prod/ingress.yaml -- verified DOES NOT EXIST in prod (exists in dev). Correctly marked as "create"
• [x] overlays/westside-ror/prod/ingress-westsidekingsandqueens.yaml -- verified DOES NOT EXIST. Correctly marked as "create"
• [x] overlays/westside-ror/prod/secrets.enc.yaml -- verified DOES NOT EXIST. Correctly marked as "create". SOPS pattern verified via believers-elite/prod/secrets.enc.yaml
• [x] overlays/westside-ror/prod/harbor-creds.enc.yaml -- verified DOES NOT EXIST. Correctly marked as "create". SOPS pattern verified via westsidekingsandqueens/prod/harbor-creds.enc.yaml

• landscaping-assistant/prod/ -- confirmed kustomization.yaml sets namespace, references bases/standard, uses Harbor image tag, deployment-patch has initContainer, individual secretKeyRef entries, security context, probes. Only has 2 files (no secrets.enc.yaml -- secrets likely managed separately)
• westsidekingsandqueens/prod/ -- confirmed has harbor-creds.enc.yaml and ingress.yaml with Tailscale Funnel pattern
• believers-elite/prod/ -- confirmed has secrets.enc.yaml with SOPS age encryption
• .sops.yaml -- confirmed path_regex \.enc\.yaml$ with age recipient key

Repo Placement

Dependencies

• #41 (Terraform onboarding) -- prerequisite, creates namespace + ArgoCD app. Status: OPEN. Documented in Lineage and Related. This ticket cannot be fully validated (ArgoCD sync) until #41 ships, but the manifests themselves can be written independently.
• #43 (Dockerfile + CI pipeline) -- sibling, sets port 3000 in Dockerfile. Status: OPEN. Documented in Context and Related. The manifests reference port 3000 which aligns with #43's plan to drop Thruster.
• #28 (Commit prod deployment manifests) -- predecessor, DONE. Created the existing dev-like prod files that this ticket replaces. Documented in Context and Related.
• #40 (Epic: CI/CD pipeline) -- parent epic. In BACKLOG. Documented in Lineage.

Acceptance Criteria

• AC 1-4: Structural checks -- agent can verify via grep/read after writing files
• AC 5: Security context -- agent can compare against landscaping-assistant pattern
• AC 6: Ingress presence -- agent can verify files exist
• AC 7-8: SOPS secrets -- agent can create with sops --encrypt and verify key count
• AC 9: Port 3000 -- agent can grep rendered output
• AC 10: kustomize build -- agent can run the test command

Blast Radius

• westsidekingsandqueens ingress conflict risk: The issue says to create ingress-westsidekingsandqueens.yaml in the westside-ror namespace for the westsidekingsandqueens hostname. The existing westsidekingsandqueens/prod/ingress.yaml currently serves that hostname from the westsidekingsandqueens namespace. The README says westsidekingsandqueens is "being replaced by westside-ror" but is "still running as the active production frontend." The issue's Context section explains this: the westsidekingsandqueens hostname was "manually created in westside-ror namespace after consolidation." This is consistent with the consolidation story. The agent implementing this should be aware that the old overlay's ingress may need to be removed separately, but the issue correctly scopes the DO-NOT-TOUCH list to exclude that.
• No impact on dev overlay -- correctly excluded from file targets
• No impact on bases/standard -- correctly excluded, patches only
• DATABASE_URL construction: The existing deployment-patch constructs DATABASE_URL from individual env vars. The new pattern uses individual secretKeyRef entries. The issue lists the correct 6 keys but does not mention DATABASE_URL construction. The agent will need to add a DATABASE_URL env var that interpolates the secret values, matching the current pattern. This is implicit in "follow landscaping-assistant pattern" but worth noting.

Decomposition Assessment

• All files are in the same directory (overlays/westside-ror/prod/)
• Strong reference patterns exist (landscaping-assistant, westsidekingsandqueens, believers-elite)
• 2 files are rewrites of existing content, 4 are new but follow established patterns
• SOPS encryption is mechanical (sops --encrypt with age key)
• Estimated agent time: ~5 minutes -- borderline but feasible in a single pass given the pattern-following nature

Observations (non-blocking)

• Missing namespace: in kustomization.yaml: The existing westside-ror kustomization does NOT set namespace: westside-ror, but the landscaping-assistant and westsidekingsandqueens patterns both set their namespace explicitly. The issue says "follow landscaping-assistant pattern" which implies the agent should add it. Not a ticket defect -- the agent should follow the pattern.
• Missing SOPS secrets.enc.yaml reference in kustomization.yaml: The issue's kustomization.yaml rewrite should add secrets.enc.yaml and harbor-creds.enc.yaml to the resources: list (as westsidekingsandqueens does for harbor-creds). Not explicitly stated but implied by "follow pattern."
• ServiceMonitor rename: The landscaping-assistant pattern renames the ServiceMonitor. The existing westside-ror kustomization does not. The agent should follow the pattern and add it.
• Project page and arch note: project-westside-ror and arch-k8s do not exist in pal-e-docs. Acknowledged as non-blocking in previous reviews.

Recommendation

• [SCOPE] Create project-westside-ror project page with user-stories section in pal-e-docs (non-blocking, acknowledged)
• [SCOPE] Create arch-k8s architecture note in pal-e-docs (non-blocking, acknowledged)