pal-e-docs

Review: Register ISS dev environment as terraform-managed service

review-1892-2026-07-20 Review

review needs-refinement
Project

Verdict: NEEDS_REFINEMENT

Re-reviewed 2026-07-20. Previous review flagged two issues; one resolved (arch-argocd note now exists), one still outstanding (invalid paldocs-dev reference).

Template Completeness

  • [x] Type — Feature
  • [x] Lineage — Standalone, discovered debugging 502
  • [x] Repo — ldraney/pal-e-services
  • [x] User Story — As a developer / I want / So that
  • [x] Context — Comprehensive: 502 cause, overlay state, Harbor/image-updater gap
  • [x] File Targets — 4 pal-e-services files + cross-repo pal-e-deployments
  • [x] Feature Flag — none
  • [x] Acceptance Criteria — 6 criteria
  • [x] Test Expectations — 4 items with run commands
  • [x] Constraints — 4 constraints
  • [x] Checklist — Present
  • [x] Related — Present
All 12 required sections present.

Traceability

  • [x] story:dev-environment label — verified in project-iss user-stories table (backing: "#192 / #193 / #194 + docs/pipeline.md")
  • [x] story note verified — found in project-iss user-stories section
  • [x] arch:argocd label — present on board item
  • [x] arch note verified — arch-argocd note exists in pal-e-docs (doc type, tags: architecture, argocd, platform). Created 2026-07-21. RESOLVED from previous review.
  • [x] Forgejo issue — ldraney/pal-e-services#192, state: open

File Targets

  • [x] terraform/k3s.tfvars — verified: symlink to secrets; confirms ISS prod registered (L370) but no dev entry exists
  • [x] terraform/k3s.tfvars.example — verified: exists, contains ISS prod entry and my-service-dev pattern (L470)
  • [x] terraform/variables.tf — verified: services type (L269-282) has no image_updater/harbor opt-out field yet
  • [x] terraform/services.tf — verified: harbor_project (L43), harbor_robot_account (L54, L90), harbor_creds secret (L127), and ArgoCD image-updater annotations (L196-202) all use unconditional for_each = var.services
  • [x] overlays/intelligentstaffingsystems/dev/*.yaml (pal-e-deployments) — verified: 7 files present, namespace consistently iss-dev across all manifests (namespace.yaml, deployment.yaml, service.yaml, ingress.yaml, configmap.yaml, kustomization.yaml)

Repo Placement

OK. Issue filed on ldraney/pal-e-services where all terraform files reside. Cross-repo dependency on pal-e-deployments is documented in File Targets section (conditional namespace rename). No separate Forgejo issue needed for pal-e-deployments — the change is minor and conditional.

Dependencies

  • Board items #1893 (pal-e-services#193 — staging) and #1894 (pal-e-services#194 — prod promotion) both depend on this ticket's opt-out flag. Documented in issue: "This ticket owns the opt-out flag; #193 and #194 consume it."
  • #193 is independent of #192 (can proceed in parallel). #194 is blocked by #193.
  • #86 (dev environment, Rails side) — done. No blockers on this ticket.
  • No items in in_progress that block this work.

Acceptance Criteria

6 criteria, all verifiable by an agent:
  • [x] Namespace exists — kubectl get ns {chosen-namespace}
  • [x] ArgoCD app Synced/Healthy — kubectl get applications.argoproj.io -n argocd
  • [x] curl returns 200 — curl -sI https://dev.intelligentstaffingsystems.ai
  • [x] No Harbor project/robot accounts — terraform plan output verification
  • [x] No image updater annotations — kubectl get app -n argocd -o yaml
  • [x] terraform plan clean — terraform plan -var-file=k3s.tfvars
All criteria are concrete and machine-verifiable. 6 ACs is at the boundary of the >5 threshold, but these are verification steps for the same terraform apply, not independent implementation work. No decomposition needed.

Blast Radius

The opt-out flag (e.g., image_updater = optional(bool, true)) defaults to true, so all 13 existing services retain current behavior with no tfvars changes. Safe.
Resources that must be gated behind the flag in services.tf:
  • harbor_project.service (L43)
  • harbor_robot_account.service_ci (L54)
  • harbor_robot_account.service_pull (L90)
  • kubernetes_secret_v1.harbor_creds (L127)
  • ArgoCD image-updater annotations in argocd_application.service (L196-202)
No similar pattern gaps found in sibling services — this is the first non-Harbor service in the stack.

Decomposition Assessment

4 file targets in 1 primary repo + conditional cross-repo rename. 6 AC (boundary case, all verification of same apply). Estimated agent time: ~5 minutes. Work is tightly coupled in one terraform directory. No decomposition needed.

Recommendation

  • [BODY] Fix invalid reference: Context section says "see paldocs-dev as reference" but no paldocs-dev service exists in k3s.tfvars or k3s.tfvars.example. Replace with reference to my-service-dev pattern in k3s.tfvars.example (line 470), or remove the reference entirely and let the agent infer the pattern from existing entries.
Previous [SCOPE] recommendation (create arch-argocd note) is RESOLVED — note was created 2026-07-21.