pal-e-docs

Review: Kustomize deployment overlays -- prod and dev

review-1695-2026-07-02 Review

review needs-refinement
Project

Verdict: NEEDS_REFINEMENT

Template Completeness

  • [x] Type -- Feature
  • [x] Lineage
  • [x] Repo
  • [x] User Story
  • [x] Context
  • [x] File Targets
  • [x] Feature Flag -- "none"
  • [x] Acceptance Criteria
  • [x] Test Expectations
  • [x] Constraints
  • [x] Checklist
  • [x] Related
All required sections present per template-issue-feature.

Traceability

  • [x] story:platform-setup label -- Platform Setup
  • [x] story note verified -- found in project-kalshi-assistant user-stories section, links to story-kalshi-assistant-platform-setup
  • [x] arch:kustomize label -- Kustomize overlays
  • [ ] arch note MISSING -- [SCOPE] Create architecture note arch-kustomize
  • [x] arch:k8s-deploy label -- Kubernetes deployment
  • [ ] arch note MISSING -- [SCOPE] Create architecture note arch-k8s-deploy
  • [x] Forgejo issue -- ldraney/kalshi-assistant#9, open

File Targets

  • [x] overlays/kalshi-assistant/prod/kustomization.yaml -- to create; matches landscaping-assistant pattern
  • [x] overlays/kalshi-assistant/prod/deployment-patch.yaml -- to create; matches landscaping-assistant pattern
  • [x] overlays/kalshi-assistant/prod/secrets.enc.yaml -- to create; matches landscaping-assistant pattern
  • [x] overlays/kalshi-assistant/dev/kustomization.yaml -- to create
  • [ ] overlays/kalshi-assistant/dev/deployment.yaml -- to create; ISSUE: dev overlay is incomplete
Dev overlay gap: The issue says "Following the landscaping-assistant model" but the dev file targets list only 2 files (kustomization.yaml, deployment.yaml). The landscaping-assistant dev overlay has 6 files: configmap.yaml, deployment.yaml, ingress.yaml, kustomization.yaml, namespace.yaml, service.yaml. The missing files (configmap, ingress, namespace, service) are required for a functional dev overlay. Without them, kustomize build for dev will fail.
Prod kustomization.yaml gap: The landscaping-assistant prod kustomization.yaml contains extensive inline patches for renaming Deployment, Service, and ServiceMonitor resources from the generic "app" name to the project name. These rename patches are not mentioned in the issue body or file targets. The implementing agent would need to infer them from the reference pattern.

Repo Placement

Mismatch: The issue ### Repo field correctly identifies ldraney/pal-e-deployments as the target repo, but the Forgejo issue is filed on ldraney/kalshi-assistant. The implementing agent's PR must target pal-e-deployments, not kalshi-assistant. This cross-repo tracking is acceptable if intentional (tracking deployment work under the project), but the agent must be explicitly directed to open the PR on the correct repo.

Dependencies

Undocumented dependencies found on the board:
  • #1694 "Service onboarding -- namespace, Harbor, ArgoCD, Tailscale funnel" (sprint:1, backlog) -- prerequisite. Kustomize overlays need the namespace and ArgoCD application to exist. This is sprint:1 work that must complete before sprint:2 overlays.
  • #1686 "Rails app scaffold with Kalshi API client" (sprint:1, backlog) -- prerequisite. The container image must exist in Harbor before the deployment can reference it.
  • #1696 "CI/CD pipeline -- Woodpecker config" (sprint:2, backlog) -- sibling. CI pipeline pushes images that the overlay references, but overlays can be created first with placeholder tags.
None of these dependencies are documented in the issue scope.

Acceptance Criteria

6 acceptance criteria, all verifiable via kustomize build output inspection:
  • [x] AC1: kustomize build renders valid manifests -- directly testable
  • [x] AC2: SOPS encryption -- testable (encryption verifiable; cluster decryption requires live cluster)
  • [x] AC3: Init container runs db:prepare -- verifiable in rendered YAML
  • [x] AC4: Probes on /up:3000 -- verifiable in rendered YAML
  • [x] AC5: Resource limits -- verifiable in rendered YAML
  • [x] AC6: Security context -- verifiable in rendered YAML
Missing AC: No acceptance criterion for the dev overlay. Test Expectations only mention kustomize build for both overlays but AC only describes prod characteristics. Dev overlay should have its own AC (nginx proxy to dev machine IP, correct namespace kalshi-dev).

Blast Radius

Low risk. 15+ services already use this overlay pattern in pal-e-deployments. The work is additive (new directory) and does not modify any existing overlays or bases. No downstream consumers are affected.

Decomposition Assessment

5 file targets in 1 repo (below the >3 files across >2 repos threshold). 6 AC (marginally above >5 threshold). However, all AC describe configuration aspects of a single deployment-patch.yaml file. The work is highly formulaic -- copying the landscaping-assistant pattern and adjusting names, secrets, and ports. Estimated agent time: 3-4 minutes. No decomposition needed.

Recommendation

  • [BODY] Add missing dev overlay file targets: configmap.yaml, ingress.yaml, namespace.yaml, service.yaml (per landscaping-assistant reference pattern)
  • [BODY] Document prod kustomization.yaml inline rename patches (Deployment, Service, ServiceMonitor) in File Targets or Context
  • [BODY] Add dependency documentation: blocked by #1694 (service onboarding) and #1686 (Rails app scaffold)
  • [BODY] Add dev-specific acceptance criteria (nginx proxy, kalshi-dev namespace)
  • [SCOPE] Create architecture note arch-kustomize for component kustomize
  • [SCOPE] Create architecture note arch-k8s-deploy for component k8s-deploy