pal-e-docs

Review: NetworkPolicy drift — add woodpecker to keycloak/postgres allow lists

review-1543-2026-06-21 Review

review needs-refinement
Project

Verdict: NEEDS_REFINEMENT

Template Completeness

  • [x] Type — Bug
  • [x] Lineage — "Discovered while setting up pal-e-services CI pipeline (pal-e-services#127)"
  • [x] Repo — ldraney/pal-e-platform
  • [x] What Broke — detailed description with error messages (connection refused, connection timed out)
  • [x] Repro Steps — 3 clear steps
  • [x] Expected Behavior — clear: both should allow ingress from woodpecker namespace
  • [x] Environment — "k3s cluster, Woodpecker 3.13.0" (present but minimal — missing cluster name/namespace detail)
  • [x] Acceptance Criteria — 2 items, both actionable
  • [x] Related — mentions manual patches as workaround

Traceability

  • [ ] story:ci-cd-pipeline label — NOT found in project-pal-e-platform user-stories section. The project defines story:superuser-deploy ("I can deploy infrastructure changes via tofu plan/apply and see them succeed in Woodpecker CI without manual intervention") which is the correct match. [LABEL] Change story:ci-cd-pipeline to story:superuser-deploy
  • [x] arch:network-policy label — present on board item
  • [ ] arch note MISSING — searched pal-e-docs for "arch-network-policy", no matching note found. [SCOPE] Create architecture note arch-network-policy for the NetworkPolicy component
  • [x] Forgejo issue — https://forgejo.tail5b443a.ts.net/ldraney/pal-e-platform/issues/456, state: open

File Targets

  • [x] terraform/network-policies.tf — verified exists at /home/ldraney/pal-e-platform/terraform/network-policies.tf
  • [x] netpol_keycloak (lines 135-159) — confirmed: allows tailscale, basketball-api, westside-ai-assistant, pal-enterprises, landscaping-assistant, monitoring. Missing woodpecker.
  • [x] netpol_postgres (lines 161-190) — confirmed: allows pal-e-app, basketball-api, pal-enterprises, cnpg-system, monitoring, westside-ror, pal-e-docs, pal-e-ror, landscaping-assistant, palinks, paldocs. Missing woodpecker.
  • [x] netpol_harbor — confirmed: already includes woodpecker at line 99. Issue claim verified.
Note: The issue body references network-policies.tf without the terraform/ prefix. The actual path is terraform/network-policies.tf. Not a blocker since the repo context is clear.

Repo Placement

OK. Issue filed on ldraney/pal-e-platform, fix is in the same repo's terraform/network-policies.tf. Single-repo change.

Dependencies

No blocking dependencies found. Related board items:
  • Item #1150 (backlog) — "[POST-INCIDENT] postgres NP missing pal-e-docs after #287 rename" — same arch:network-policy pattern, historical precedent for this class of bug. Not a blocker.
  • Item #1480 (backlog) — "Woodpecker CI: tofu plan on PR, apply on merge (platform)" — this is the downstream feature that needs the NetworkPolicy fix first. Item #1543 unblocks #1480 but this dependency is not documented in the issue.
  • Item #1481 (backlog) — "Woodpecker CI: tofu plan on PR, apply on merge (services)" — also blocked by this NetworkPolicy gap per the Lineage section (pal-e-services#127).

Acceptance Criteria

Both AC are verifiable by an agent:
  • AC1: grep terraform/network-policies.tf for woodpecker in netpol_keycloak block — pass/fail
  • AC2: grep terraform/network-policies.tf for woodpecker in netpol_postgres block — pass/fail
Missing AC: No validation that tofu plan/apply succeeds after the change. Consider adding: "tofu plan shows no errors for netpol_keycloak and netpol_postgres resources". However, this is a 2-point chore and the AC are sufficient for the code change itself.

Blast Radius

Low. The file contains 10 NetworkPolicy resources total. Only keycloak and postgres are affected. No other namespaces appear to be missing woodpecker that should have it — woodpecker only needs keycloak (for OIDC token validation during tofu plan) and postgres (for database provider connections). Harbor already has it. The remaining namespaces (basketball-api, pal-enterprises, etc.) do not need woodpecker ingress.

Decomposition Assessment

No decomposition needed. 2 acceptance criteria, 1 file target, 1 repo. Estimated agent work: under 2 minutes. Well within the 5-minute rule.

Recommendation

  • [LABEL] Change story:ci-cd-pipeline to story:superuser-deploy — the project-pal-e-platform user-stories section defines story:superuser-deploy for CI/CD pipeline work, not story:ci-cd-pipeline
  • [SCOPE] Create architecture note arch-network-policy for the NetworkPolicy component — no backing note exists in pal-e-docs despite the arch:network-policy label being used on multiple board items (#1150, #1543)