pal-e-docs

Review: deploy#242 ISS staging: provision CNPG database + re-add migrate init container (re-review)

review-1928-2026-07-26-r2 Review

review ready
Project

Verdict: READY

Re-review after refinement. Previous review review-1928-2026-07-26 issued NEEDS_REFINEMENT with three [BODY] recommendations. All three have been addressed in the updated issue body.

Previous Recommendations -- Resolution

  • [x] Clarify CNPG database provisioning mechanism -- ADDRESSED. Context section now documents: "done by adding the database name to the CNPG Cluster CR's managed.databases list in pal-e-services, or by running CREATE DATABASE via psql." Note: the actual mechanism is databases.tf using the postgresql_database Terraform resource with the service_databases variable (not CNPG managed.databases), and k3s.tfvars.example already has the iss-staging entry prepared with all 4 databases. The mechanism name is imprecise but the intent (declarative provisioning in pal-e-services) is correct and does not affect the file targets for this ticket.
  • [x] Add explicit cross-repo sequencing -- ADDRESSED. Issue now states: "The config/database.yml change in ldraney/intelligentstaffingsystems is a hard prerequisite -- without DATABASE_URL support, the init container would still connect to the prod database regardless of env vars set in the overlay. That ISS-repo PR must merge first; then this overlay PR can land."
  • [x] Add DATABASE_URL env var to file target descriptions -- ADDRESSED. File targets now explicitly state: deployment-patch.yaml gets DATABASE_URL in both init container and app container; secrets.enc.yaml gets DATABASE_URL pointing to intelligentstaffingsystems_staging.

Template Completeness

  • [x] Type -- Feature
  • [x] Lineage -- Follow-up from PR #241
  • [x] Repo -- ldraney/pal-e-deployments
  • [x] User Story
  • [x] Context -- Includes CNPG provisioning and cross-repo sequencing
  • [x] File Targets -- Two pal-e-deployments files + one cross-repo prerequisite
  • [x] Feature Flag -- none
  • [x] Acceptance Criteria -- 4 items
  • [x] Test Expectations -- kubectl kustomize build command
  • [x] Constraints -- Including cross-repo merge ordering
  • [x] Checklist
  • [x] Related -- project-iss, #198, #199, PR #241

Traceability

  • [x] story:dev-environment label -- Dev environment pipeline story
  • [x] story note verified -- found in project-iss user-stories section (key: dev-environment, backing: #192/#193/#194 + docs/pipeline.md)
  • [x] arch:kustomize label -- Kustomize overlays
  • [x] arch note verified -- arch-kustomize note exists in pal-e-docs (covers kustomize overlay conventions)
  • [x] Forgejo issue -- https://forgejo.tail5b443a.ts.net/ldraney/pal-e-deployments/issues/242, open

File Targets

  • [x] overlays/intelligentstaffingsystems/staging/deployment-patch.yaml -- verified: file exists, currently has no init container (removed in commit 9869037). Issue correctly specifies re-adding init container with DATABASE_URL and adding DATABASE_URL to app container.
  • [x] overlays/intelligentstaffingsystems/staging/secrets.enc.yaml -- verified: file exists, SOPS-encrypted, currently has POSTGRES_USER/PASSWORD/HOST but no DATABASE_URL. Issue correctly specifies adding DATABASE_URL.
  • [x] ldraney/intelligentstaffingsystems/config/database.yml (cross-repo prerequisite) -- verified: production section hardcodes database name intelligentstaffingsystems with no DATABASE_URL support. Correctly marked as must-merge-first.
  • [x] Prod overlay correctly marked as do-not-touch. Prod deployment-patch.yaml has a working migrate init container using POSTGRES_USER/PASSWORD/HOST pattern -- staging will use DATABASE_URL instead to override the hardcoded database name.

Repo Placement

Correct. Issue filed on pal-e-deployments for the overlay work. Cross-repo dependency on intelligentstaffingsystems clearly documented with sequencing. CNPG provisioning (pal-e-services) is a separate prerequisite handled via terraform apply, not a code change in this PR.

Dependencies

Well documented. Peer staging tickets on board-iss:
  • #1930 platform#560 -- DNS CNAME (backlog)
  • #1931 svc#198 -- Caddy reverse proxy (backlog)
  • #1932 svc#199 -- Harbor pull secret (backlog)
Issue correctly notes staging needs all peers to be fully functional. Cross-repo prerequisite (ISS database.yml) is now explicitly documented with merge ordering.

Acceptance Criteria

4 AC items, all verifiable by an agent. kubectl kustomize overlays/intelligentstaffingsystems/staging is a concrete runnable command. "Prod database is unaffected" is verifiable by confirming prod overlay unchanged and staging DATABASE_URL targets the staging database.

Blast Radius

Low. ISS is the only service with a staging overlay. Other services with migrate init containers (palinks, basketball-api, landscaping-assistant) are unaffected. Other overlays (westside-basketball, paldocs) already use DATABASE_URL successfully -- ISS staging follows an established pattern.

Decomposition Assessment

2 file targets in 1 repo, 4 AC. Well within the 5-minute rule. Cross-repo prerequisite is a separate PR, not part of this agent pass. No decomposition needed.

Recommendation

No action needed. All previous recommendations addressed. Minor note: the Context section describes the CNPG provisioning mechanism as "managed.databases" when the actual mechanism is databases.tf using the postgresql_database Terraform resource with the service_databases variable. This does not affect the ticket scope or file targets -- the provisioning is a prerequisite handled separately, and k3s.tfvars.example already has the iss-staging entry prepared.