Review: Fix westside-app Harbor auth (4 alerts) — v2

Verdict: READY

Template Completeness

• [x] Lineage — present in original body
• [x] Repo — original listed pal-e-services + pal-e-deployments; refinement correctly adds westside-app
• [x] User Story — present
• [x] Context — thorough root cause analysis with skopeo confirmation
• [x] File Targets — complete in refinement: 4 files across 3 repos with line-level specificity
• [x] Acceptance Criteria — updated in refinement to include CI pipeline success
• [x] Test Expectations — present with kubectl, skopeo, and blackbox probe checks
• [x] Constraints — present (tofu apply -lock=false, CI config caveat)
• [x] Checklist — present
• [x] Related — present (references #109 umbrella and PR #37)

File Targets

• [x] ~/pal-e-services/terraform/k3s.tfvars line 34 — verified: contains image_repo = "westside-app/app" under the westsidekingsandqueens service key. Mismatch confirmed.
• [x] ~/pal-e-deployments/overlays/westsidekingsandqueens/prod/kustomization.yaml — verified: lines 63 and 65 reference harbor.tail5b443a.ts.net/westside-app/app. Must change to westsidekingsandqueens/app.
• [x] ~/westside-app/.woodpecker.yaml line 24 — verified: repo: westside-app/app. Must change to westsidekingsandqueens/app.
• [x] ~/pal-e-services/terraform/services.tf — verified: harbor_project.service uses each.key as project name (line 11), and robot accounts are scoped to harbor_project.service[each.key].name (lines 48, 72). This confirms the architectural root cause.

Repo Placement

• forgejo_admin/pal-e-services — k3s.tfvars change + tofu apply
• forgejo_admin/pal-e-deployments — kustomization image refs
• forgejo_admin/westside-app — Woodpecker CI push target

Dependencies

• Board item #188 (issue #109) — in_progress. Umbrella "platform cleanup" issue. #110 is a child. No blocking relationship.
• Board item #171 (todo-harbor-pull-secret-drift) — in next_up. Addresses the same class of bug (robot scope mismatch causing ImagePullBackOff). The todo describes a SOPS-based architectural fix. #110 fixes the immediate symptom; #171 prevents recurrence. Cross-reference recommended but no dependency.
• Option B deferred — the refinement explicitly defers the services.tf architectural fix. Should become a separate ticket or fold into #171.

Acceptance Criteria

• curl check, pod status, alert clearing, CI pipeline success — all verifiable by agent.

Blast Radius

• mcd-tracker-app has the same class of mismatch: key=mcd-tracker-app, image_repo=mcd-tracker/app. Harbor project created as mcd-tracker-app, robot scoped there. But ArgoCD image updater annotation points to mcd-tracker/app (wrong). CI pushes to mcd-tracker-app/app and kustomization references mcd-tracker-app/app — so pulls work today. Image updater is broken but masked by manual tag pinning. Ticking time bomb — flag for #171 or separate ticket.
• All other services (6 of 8) have matching key/image_repo prefixes — no blast radius.
• Execution order matters: tofu apply must run before kustomization change, or ArgoCD will sync to an empty Harbor project and 401 again.

Recommendation

• Execution order: (1) Change k3s.tfvars + tofu apply (creates Harbor project + robot), (2) Update + merge westside-app .woodpecker.yaml (CI pushes image to new project), (3) Update pal-e-deployments kustomization with new image path + tag from CI run. Without this sequencing, ArgoCD may sync to an empty project.
• mcd-tracker-app mismatch should be documented as discovered scope — new ticket or fold into #171.

Previous Reviews