pal-e-docs

Review: Update KEYCLOAK_URL for landscaping-assistant (re-review)

review-1483-2026-06-17-r2 Review

review ready
Project

Verdict: READY

Re-review of board item #1483 after issue body fixes. Previous review (review-1483-2026-06-17) found NEEDS_REFINEMENT due to repo mismatch and unclear file targets. Both [BODY] issues have been resolved.

Template Completeness

  • [x] Type -- Feature
  • [x] Lineage -- References godaddy-tofu#36 and pal-e-platform#454
  • [x] Repo -- ldraney/pal-e-deployments (corrected from pal-e-services, with cross-repo note)
  • [x] User Story
  • [x] Context -- Thorough: explains experimental verification, manual kubectl override, two options with preference stated
  • [x] File Targets -- Two files, both clearly described (one create, one conditional modify)
  • [x] Feature Flag -- None (acceptable for secret config change)
  • [x] Acceptance Criteria -- 4 criteria
  • [x] Test Expectations -- 2 concrete commands
  • [x] Constraints -- SOPS encryption, service scope, ordering dependency
  • [x] Checklist
  • [x] Related
All required sections for a Feature issue are present and complete.

Traceability

  • [x] story:custom-domains label -- present on board item
  • [ ] story note MISSING -- story:custom-domains is not listed in the project-pal-e-platform user-stories section. Existing stories: superuser-deploy, superuser-observe, superuser-recover, superuser-onboard-service, superuser-remote-access, superuser-sso, superuser-unified-ui, superuser-docs-frontend. [SCOPE] Create user story entry for story:custom-domains on project-pal-e-platform user-stories section. (Carried from previous review -- does not block implementation.)
  • [x] arch:keycloak label -- present on board item
  • [ ] arch note MISSING -- search for arch-keycloak in pal-e-docs returned zero results. [SCOPE] Create architecture note arch-keycloak for the Keycloak component. (Carried from previous review -- does not block implementation.)
  • [x] Forgejo issue -- ldraney/pal-e-services#121, state: open

File Targets

  • [x] pal-e-deployments/overlays/landscaping-assistant/prod/secrets.enc.yaml -- verified: file does NOT exist (as expected, issue says "create new file"). Reference pattern confirmed: believers-elite/prod/secrets.enc.yaml and palinks/prod/secrets.enc.yaml both exist with SOPS-encrypted Kubernetes Secrets. The believers-elite example shows the expected structure (apiVersion, kind, metadata, stringData with encrypted values, sops metadata block).
  • [x] pal-e-deployments/overlays/landscaping-assistant/prod/kustomization.yaml -- verified: file exists. Currently does NOT list secrets.enc.yaml in its resources: block. The believers-elite kustomization.yaml shows the pattern: - secrets.enc.yaml added to the resources list. This file will need modification to add the secrets resource.

Repo Placement

RESOLVED. Issue is filed on ldraney/pal-e-services but the Repo field now correctly states ldraney/pal-e-deployments with an explicit cross-repo note explaining why. The deployment-patch.yaml in pal-e-deployments references KEYCLOAK_URL via secretKeyRef from landscaping-assistant-secrets (lines 62-66 and 134-138). Change will be made in the correct repo.

Dependencies

  • Board item #1482 (Codify Keycloak public ingress IaC / pal-e-platform#454) -- in backlog, 3 points. This is a hard dependency per Constraints: "Must be applied AFTER pal-e-platform#454 (KC_HOSTNAME removal + Caddy config)." Both items share story:custom-domains and arch:keycloak labels. #1482 must move to done before #1483 can be implemented.
  • godaddy-tofu#36 -- docs, soft dependency, not blocking.
Dependencies are well-documented in the issue body (Lineage, Constraints, Related sections).

Acceptance Criteria

Four acceptance criteria plus two test expectations. All are agent-verifiable:
  • AC1 (KEYCLOAK_URL value) -- verifiable via kubectl secret inspection, command provided in Test Expectations
  • AC2 (ArgoCD sync) -- verifiable via ArgoCD CLI/UI after merge
  • AC3 (login redirect to auth.palinks.app) -- verifiable via curl, command provided in Test Expectations
  • AC4 (internal Tailscale access) -- verifiable but slightly vague; acceptable for a 1-point ticket
Test commands are real and actionable. Criteria count (4) is within the 5-minute rule.

Blast Radius

pal-enterprises also references KEYCLOAK_URL via secretKeyRef in its deployment-patch.yaml (line 40). It also has no secrets.enc.yaml (same manual secret pattern). If the platform goal is to move all Keycloak URLs to public domain, pal-enterprises will need a follow-up ticket. The issue correctly constrains scope: "This change only affects landscaping-assistant, not other apps." No other services reference KEYCLOAK_URL in pal-e-deployments.

Decomposition Assessment

2 file targets in 1 repo (1 create, 1 modify), 4 acceptance criteria, estimated <5 minutes of agent work. No decomposition needed.

Recommendations

  • [SCOPE] Create user story entry for story:custom-domains on the project-pal-e-platform user-stories section. (Carried forward -- platform documentation debt, does not block this ticket.)
  • [SCOPE] Create architecture note arch-keycloak for the Keycloak component. (Carried forward -- platform documentation debt, does not block this ticket.)
All [BODY] issues from the previous review have been resolved. The two remaining [SCOPE] items are platform-level documentation debts that should be addressed but do not block implementation of this specific ticket.