pal-e-docs

Review: Fix westside-app Harbor auth (4 alerts)

review-189-2026-03-18-westside-harbor Review

review needs-refinement
Project

Verdict: NEEDS_REFINEMENT

Template Completeness

  • [x] Lineage
  • [x] Repo
  • [x] User Story
  • [x] Context
  • [x] File Targets
  • [x] Acceptance Criteria
  • [x] Test Expectations
  • [x] Constraints
  • [x] Checklist
  • [x] Related

File Targets

  • [x] ~/pal-e-services/terraform/k3s.tfvars — verified: westsidekingsandqueens service key with image_repo = "westside-app/app" confirmed at lines 32-39. Mismatch between key and image_repo project prefix is real.
  • [x] ~/pal-e-services/terraform/services.tf — verified: robot accounts scoped to harbor_project.service[each.key].name (lines 48, 72), which resolves to the service key, not the image_repo project. This is the root cause.
  • [x] ~/pal-e-deployments/overlays/westsidekingsandqueens/prod/kustomization.yaml — verified: image references point to harbor.tail5b443a.ts.net/westside-app/app with tag c191cdd41ae6ab07a197630e3396c4048f30dc67.

Repo Placement

Issue is filed on forgejo_admin/pal-e-platform, but the Repo section correctly identifies forgejo_admin/pal-e-services as primary and forgejo_admin/pal-e-deployments as secondary. Since pal-e-platform is the umbrella project for platform health, filing here is acceptable. However, the actual PR(s) will be against pal-e-services and possibly pal-e-deployments. The agent needs clear guidance on which repo to branch/PR against.

Dependencies

  • Board item #188 (Issue #109: Platform cleanup — resolve 15 alerts + stabilize CI) is in_progress and appears to be the umbrella issue. This ticket is one of its children. No blocking dependency.
  • Board item #176 (Post-Move Network Recovery) is in_progress — no conflict.
  • Board item #171 (todo-harbor-pull-secret-drift) is in next_up — this is directly related. That TODO addresses the same class of bug (Harbor pull secret drift). These should be coordinated or the TODO should be superseded by the architectural fix (Option B).

Acceptance Criteria

All 3 acceptance criteria are verifiable by an agent:
  • curl to the funnel URL — automatable
  • kubectl get pods — automatable
  • Alert clearing — verifiable via Prometheus query, though may require wait time
Test expectations are also concrete and automatable. Good.

Blast Radius

Critical finding: mcd-tracker-app has the same class of bug.
  • Service key: mcd-tracker-app, image_repo = "mcd-tracker/app"
  • Robot account is scoped to Harbor project mcd-tracker-app, but image_repo points to project mcd-tracker
  • Currently not failing because the deployed image actually uses harbor.tail5b443a.ts.net/mcd-tracker-app/app:latest (the Harbor project matching the key), not the one in image_repo. This means CI is pushing to mcd-tracker/app per Woodpecker config, but the deployed image was pulled from mcd-tracker-app/app — suggesting a manual or historical push to the matching project.
  • This will break on the next CI deploy if not addressed.
All other services have matching keys and image_repo prefixes: platform-validation, basketball-api, pal-e-docs, pal-e-app, gcal-scheduler, mcd-tracker.

Recommendation

Verdict is NEEDS_REFINEMENT for the following reasons:
  • Design decision must be made before dispatch. The ticket presents Option A vs Option B but does not commit to one. An agent cannot proceed without knowing which option to implement. Betty Sue or Lucas must decide.
  • Blast radius is understated. The ticket does not mention that mcd-tracker-app has the identical key/image_repo mismatch. If Option B is chosen, both services are fixed. If Option A is chosen, a separate ticket is needed for mcd-tracker-app.
  • Related board item #171 (todo-harbor-pull-secret-drift) should be referenced. If Option B is chosen, that TODO may be resolved by this fix and should be marked accordingly.
  • Westside-app Woodpecker CI config (.woodpecker.yaml) pushes to westside-app/app (line 24). If Option A is chosen (change image_repo to westsidekingsandqueens/app), the CI config must also change — and this is in a different repo (forgejo_admin/westside-app), requiring a second PR. The ticket mentions this as a possibility in Constraints but should make it explicit in File Targets.
Specific actions to make this READY:
  • Commit to Option A or B in the issue body
  • Add mcd-tracker-app to blast radius / create a sibling ticket
  • If Option A: add ~/westside-app/.woodpecker.yaml to File Targets and note the second PR requirement
  • If Option B: note that services.tf needs to parse the project prefix from image_repo and scope robots accordingly, and add mcd-tracker-app to scope
  • Reference board item #171 in Related