Review: Codify westside-basketball manual fixes: funnel ingress, overlay rename

Verdict: NEEDS_REFINEMENT

Template Completeness

• [x] Type — Bug
• [x] Lineage — discovered during sprint 5 validation
• [x] Repo — ldraney/pal-e-deployments
• [x] What Broke — five manual fixes described
• [x] Repro Steps — ArgoCD resync scenario
• [x] Expected Behavior — full IaC, no manual intervention
• [x] Environment — prod, westside-basketball namespace
• [x] Acceptance Criteria — 8 items listed
• [x] Related — references SOPs and related PRs

Traceability

• [x] story:WS-S1 label — "As superadmin, I want to deploy platform changes via IaC so that infrastructure is reproducible and auditable"
• [x] story note verified — found in project-westside-basketball user-stories section (Superadmin block)
• [x] arch:iac label — present on board item
• [ ] arch note MISSING — [SCOPE] No architecture note arch-iac found in pal-e-docs. Create architecture note for the IaC component.
• [x] Forgejo issue — ldraney/pal-e-deployments#220, state: open

File Targets

• [x] pal-e-deployments/overlays/westside-ror/prod/ — verified: directory exists, contains kustomization.yaml and deployment-patch.yaml with 10+ westside-ror references needing rename
• [x] pal-e-deployments/overlays/westside-ror/prod/kustomization.yaml — verified: 6 occurrences of value: westside-ror in env var patches
• [x] pal-e-services/terraform/k3s.tfvars line 274 — verified: source_path = "overlays/westside-ror/prod" needs update to westside-basketball
• [x] pal-e-platform/terraform/network-policies.tf line 181 — verified: westside-ror namespace selector in postgres ingress rules
• [x] westside-basketball/.woodpecker.yaml line 110 — verified: OVERLAY: "westside-ror" needs update
• [ ] westside-basketball/.woodpecker.yaml depends_on — ISSUE: ticket says update-kustomize-tag needs depends_on: [build-and-push], but this ALREADY EXISTS (lines 116-117). The actual bug is status: [success, failure] on line 121 which causes the step to run even when build-and-push fails. Ticket body needs correction.
• [ ] Database role changes — ISSUE: ticket mentions dropping stale basketball role and reassigning ownership, but does not specify which repo/file contains this IaC. The k3s.tfvars (line 22) shows databases = ["basketball", ...] — these database names also use the old convention. No file target given for the DB role fix.

Additional Findings (not in ticket)

• [ ] pal-e-services/terraform/k3s.tfvars lines 156-175 — Keycloak config has 5 stale westside-ror references (client_id, redirect URIs, root_url, web_origins). These will break auth if overlay is renamed without updating Keycloak config.
• [ ] pal-e-deployments/overlays/westsidekingsandqueens/prod/kustomization.yaml line 6 — comment says "ingress.yaml removed — westsidekingsandqueens URL now served by westside-ror namespace." This comment becomes stale after rename and the relationship between the two overlays is not documented in the ticket.
• [ ] pal-e-deployments/overlays/westside-ror/dev/ — dev overlay has service.yaml, deployment.yaml, ingress.yaml all with westside-ror references. Not mentioned in ticket scope.
• [ ] pal-e-deployments/overlays/westside-ror/prod/deployment-patch.yaml line — has path: /home/ldraney/westside-ror hostPath reference

Repo Placement

Dependencies

• No blocking items found in in_progress or next_up columns
• Closed issue #218 and PR #219 (namespace hotfix) are related predecessors — already merged
• Implicit ordering: overlay rename must happen before source_path update, or ArgoCD will break
• Keycloak redirect URIs must update simultaneously with overlay rename or auth breaks

Acceptance Criteria

• AC1 (funnel ingress in overlay): Verifiable — check file exists in kustomization
• AC2 (overlay rename): Verifiable — check directory name and resource names
• AC3 (source_path update): Verifiable — grep k3s.tfvars
• AC4 (NetworkPolicy): Verifiable — grep network-policies.tf
• AC5 (drop basketball role): NOT verifiable by agent — requires DB access, no IaC file target specified
• AC6 (CI depends_on): ALREADY DONE — depends_on exists. Real fix is removing status: [success, failure]
• AC7 (ArgoCD sync): Integration test — requires cluster access, not agent-verifiable
• AC8 (SOP updated): Already marked done in ticket

Blast Radius

• Keycloak redirect URIs at lines 165-175 of k3s.tfvars still reference westside-ror.tail5b443a.ts.net. If the Tailscale hostname changes with the rename, auth will break for all users.
• The westsidekingsandqueens overlay has its own prod directory with a separate ingress.yaml pointing to service westside-app. The relationship between these two overlays and which one ArgoCD actually uses needs documentation.
• Harbor image repo is already westside-basketball/app (correct), but the westsidekingsandqueens overlay references harbor.tail5b443a.ts.net/westsidekingsandqueens/app — a different image path. Unclear which is canonical.

Decomposition Assessment

• File targets: 6+ files across 4 repos (threshold: >3 files across >2 repos)
• Acceptance criteria: 8 items (threshold: >5)
• Estimated agent work: 15-20 minutes across 4 repos with terraform apply + ArgoCD sync verification
• Points: 3 pts is too low for this scope — realistic estimate is 8+ pts

• pal-e-deployments: Rename overlay directory, add funnel ingress to prod kustomization, update all resource names (3pts)
• pal-e-services: Update source_path in k3s.tfvars, fix Keycloak redirect URIs (2pts)
• pal-e-platform: Update NetworkPolicy namespace selector (1pt)
• westside-basketball: Fix OVERLAY env var in CI, remove status: [success, failure] from update-kustomize-tag step (1pt)

Recommendation

• [BODY] Fix AC6: depends_on: [build-and-push] already exists. The real bug is status: [success, failure] on line 121 which causes update-kustomize-tag to run even when build-and-push fails. Rewrite AC to: "Remove status: [success, failure] from update-kustomize-tag when clause"
• [BODY] Add missing file targets: Keycloak redirect URIs in pal-e-services/terraform/k3s.tfvars lines 156-175 (5 stale westside-ror references)
• [BODY] Add file target for database role cleanup or split into separate spike ticket
• [BODY] Document the westsidekingsandqueens vs westside-ror overlay relationship and which one ArgoCD uses
• [SCOPE] Create architecture note arch-iac for the IaC component
• [DECOMPOSE] 8 AC across 4 repos, estimated 15-20 min agent work. Route to skill-decompose-ticket for sub-ticket creation by repo.