pal-e-docs

Review: #111 Fix Keycloak probe (1 alert)

review-190-2026-03-18 Review

review ready
Project

Verdict: READY

Template Completeness

  • [x] Lineage
  • [x] Repo
  • [x] User Story
  • [x] Context
  • [x] File Targets
  • [x] Acceptance Criteria
  • [x] Test Expectations
  • [x] Constraints
  • [x] Checklist
  • [x] Related
All required sections from template-issue are present and well-populated.

File Targets

  • [x] terraform/network-policies.tf line ~130 — verified: Keycloak NetworkPolicy (lines 119-136) only allows ingress from tailscale namespace. Every other service (forgejo, harbor, argocd, woodpecker, postgres, minio) includes a monitoring namespace rule. The fix is a one-line addition matching the existing pattern.
  • [x] terraform/main.tf line ~439 — verified: Keycloak probe at line 440 uses https://keycloak.tail5b443a.ts.net (external funnel URL). All other platform-tier services (forgejo, woodpecker, grafana, alertmanager, harbor, argocd, minio) use internal svc.cluster.local URLs. The proposed replacement http://keycloak.keycloak.svc.cluster.local:80/realms/master matches the Kubernetes service definition at line 1981 (port 80, target_port 8080).

Repo Placement

OK. Both file targets are in forgejo_admin/pal-e-platform which matches the Forgejo issue repo. Single-repo fix, no cross-repo coordination needed.

Dependencies

  • Board item #188 (Issue #109: Platform cleanup umbrella) is in_progress — this issue is a child of that umbrella. No blocking dependency; coordination only.
  • Board item #192 (Issue #113: Terraform state drift) is in todo — the ticket's Constraints section mentions bundling with state drift apply. This is an execution optimization, not a hard dependency.
  • No other board items are blocked by or block this ticket.

Acceptance Criteria

All three criteria are agent-verifiable:
  • probe_success{service="keycloak"} == 1 — verifiable via PromQL query post-apply
  • Keycloak NetworkPolicy includes monitoring namespace — verifiable via tofu plan diff
  • EndpointDown alert clears — verifiable via Alertmanager API or Grafana dashboard
Test Expectations are concrete: tofu plan -lock=false shows two changes, curl from blackbox pod returns 200, Prometheus target UP. All executable.

Blast Radius

  • No similar pattern bugs found. Keycloak was the only platform service using an external funnel URL for its blackbox probe. All others already use internal cluster URLs.
  • No other NetworkPolicies missing monitoring. All 7 other NetworkPolicy resources in network-policies.tf already include the monitoring namespace rule. Keycloak was the sole outlier.
  • Downstream: no consumers depend on the probe URL value — it only affects Prometheus blackbox exporter scraping.

Recommendation

No action needed. Scope is precise, file targets verified, two-line change with clear acceptance criteria. Ready for agent dispatch.