Review: Add rails-env Kubernetes secret for westside-basketball in terraform

Verdict: READY

Template Completeness

• [x] Type -- Feature
• [x] Lineage -- Standalone, discovered during Sprint 5 validation
• [x] Repo -- ldraney/pal-e-services
• [x] User Story -- Platform operator / rails-env secret in IaC
• [x] Context -- Clear motivation, references existing harbor_creds pattern
• [x] File Targets -- 3 files to modify, 2 exclusions documented
• [x] Feature Flag -- none (correct, infrastructure work)
• [x] Acceptance Criteria -- 6 criteria covering plan, apply, and runtime
• [x] Test Expectations -- tofu plan + kubectl verification
• [x] Constraints -- Pattern reference, sensitive vars, DB prerequisite noted
• [x] Checklist -- Standard PR checklist
• [x] Related -- Sprint 5 context, upstream dependencies

Traceability

• [x] story:WS-S1 label -- "As superadmin, I want to deploy platform changes via IaC so that infrastructure is reproducible and auditable"
• [x] story note verified -- found in project-westside-basketball user-stories section under Superadmin (Lucas)
• [x] arch:iac label -- infrastructure-as-code component
• [ ] arch note MISSING -- [SCOPE] Create architecture note arch-iac for component iac. Non-blocking: the arch:iac label is semantically correct and the work pattern (terraform resources) is well-established in this repo.
• [x] Forgejo issue -- ldraney/pal-e-services#150, open

File Targets

• [x] terraform/services.tf -- verified: file exists (245 lines), contains kubernetes_secret_v1.harbor_creds pattern at line 127 that the new resource should follow. No existing rails-env resource.
• [x] terraform/variables.tf -- verified: file exists (248 lines), contains existing credential variables (e.g., paledocs_db_password, cnpg_superuser_password) with sensitive = true. Has service_databases map variable that could be an alternative pattern, but standalone variables match the ticket's approach.
• [x] terraform/k3s.tfvars -- verified: file exists (symlink to ~/secrets/pal-e-services/k3s.tfvars), contains credential values for other services. westside-basketball service entry present at line 262.
• [x] terraform/cnpg.tf (exclusion) -- verified: file exists, CNPG cluster named pal-e-postgres in postgres namespace. Correctly excluded from scope.
• [x] terraform/keycloak.tf (exclusion) -- confirmed unrelated

Repo Placement

Dependencies

• westside-basketball#69 (CI fix) -- in validation column, merged. Image in Harbor. Not a blocker for this ticket.
• pal-e-deployments#219 (namespace fix) -- in validation column, merged. Deployment overlay at overlays/westside-ror/prod references rails-env secret at line 29 of deployment-patch.yaml. Confirmed.
• Database prerequisite -- The basketball database must exist on the CNPG cluster. Issue correctly notes this as a manual step outside terraform scope. This is a runtime dependency, not a ticket dependency.
• Namespace alignment -- The service key is westside-basketball (namespace), but ArgoCD source_path is overlays/westside-ror/prod. The kustomize renames the deployment to westside-ror within the westside-basketball namespace. The secret must be created in namespace westside-basketball, which is what the ticket specifies. Correct.

Acceptance Criteria

• AC1-3: Structural checks on terraform code -- agent can verify via file read
• AC4-5: tofu plan and tofu apply -- agent can run these commands (CI pipeline exists)
• AC6: Pod starts without CreateContainerConfigError -- verifiable via kubectl, though requires the database to exist first (noted in constraints)

Blast Radius

• westside-docs dev overlay also uses rails-env secretRef (different namespace, different environment). Not affected by this change.
• Issue correctly identifies 12 services with manually-created secrets -- this ticket is scoped to westside-basketball only, with follow-up planned. No blast radius concern.
• The new kubernetes_secret_v1 resource is standalone (not part of the for_each services loop), so it won't affect other services.

Decomposition Assessment

Recommendation

• [SCOPE] Create architecture note arch-iac for the IaC component. Non-blocking -- this is a documentation gap across the platform, not specific to this ticket.