pal-e-docs

Review: Apply Terraform state drift (3 alerts)

review-192-2026-03-18 Review

review ready
Project

Verdict: READY

Template Completeness

  • [x] Lineage — present, references plan-pal-e-platform → Platform Hardening
  • [x] Repo — present, forgejo_admin/pal-e-platform
  • [x] User Story — present, well-formed As/I want/So that
  • [x] Context — present, explains root cause (CI clone failures from Issue #107) and lists the 2 key unapplied PRs
  • [x] File Targets — present, lists terraform/main.tf and terraform/network-policies.tf; explicitly notes no code changes needed
  • [x] Acceptance Criteria — present, 4 criteria covering apply success, Prometheus target, backup verify, and state convergence
  • [x] Test Expectations — present, 4 testable commands with concrete verification steps
  • [x] Constraints — present, documents Issue #107 blocker, manual apply workaround, and plan-first approach
  • [x] Checklist — present, 5 items
  • [x] Related — present, links to Issue #107, #109, PR #93, PR #95

File Targets

  • [x] terraform/main.tf — verified: file exists (2300+ lines). Contains cnpg-backup-verify CronJob with PR #93's WAL skip fix at lines 2326-2330. Ticket correctly says no code changes needed.
  • [x] terraform/network-policies.tf — verified: file exists (197 lines). Contains netpol_postgres resource at line 138 with monitoring ingress rule from PR #95 at line 152. Ticket correctly says no code changes needed.

Repo Placement

Correct. Issue is filed on forgejo_admin/pal-e-platform, which is where both terraform/main.tf and terraform/network-policies.tf live. The merged PRs (#93, #95) are also on this repo. No cross-repo concerns.

Dependencies

  • Issue #107 (TLS clone fix) — listed as blocker for CI-driven apply. Verified: Issue #107 is now closed and board item #187 is in done. This blocker is resolved. The ticket's constraint about manual apply as interim is now moot — CI should work.
  • Issue #109 (umbrella alert cleanup) — listed as related. Verified: Issue #109 is open and board item #188 is in_progress. This issue (#113) is one of the child work items under that umbrella. No conflict.
  • PRs #93, #95 — both confirmed merged in git history (commits 28e3609 and ab5ed20 respectively). Code is in main, just unapplied to the cluster.

Acceptance Criteria

All 4 criteria are agent-verifiable:
  • tofu apply exit code — directly testable
  • Prometheus target UP — testable via kubectl or promtool query
  • Backup verify CronJob — testable by triggering a manual job run and checking exit code
  • Cluster state matches Terraform — testable via tofu plan showing no diff
Test commands in the Test Expectations section are concrete and real. The -lock=false flag follows repo convention (per MEMORY.md feedback_tofu_lock_false).

Blast Radius

  • The ticket says "5+ merged PRs" but only names PRs #93 and #95 explicitly. Checking git history, additional merged PRs since last apply include: #97 (Docker bridge nftables), #100 (CI lock-aware retry), #102 (Woodpecker encryption key), #106 (westside-dev blackbox probe), #108 (Woodpecker-to-Forgejo internal URL). A tofu plan will show all drift, not just the 2 named PRs. The ticket's acceptance criterion "no unrelated changes" and constraint "review the plan output" cover this — the operator must review the full plan before applying.
  • Network policy changes (PR #95) only add an ingress rule to postgres namespace from monitoring — this is additive, not restrictive. No risk of breaking existing traffic.
  • Backup verify fix (PR #93) only adds a skip condition for new clusters without WAL archives — no risk to existing backup workflows.

Recommendation

No action needed — scope is solid. One minor note: the ticket title says "5+ merged PRs" but git history shows at least 7 merged PRs since last apply (not just 5). This is cosmetic and does not affect execution. The key instruction — run tofu plan first, review output, then apply — is the correct workflow regardless of count. The Issue #107 blocker is now resolved, so CI-driven apply should work without manual intervention.