pal-e-docs

Review: MinIO network policy: allow pal-e-mail ingress

review-284-2026-03-22 Review

review ready
Project

Verdict: READY

Template Completeness

  • [x] Lineage — present: plan-pal-e-mail → Phase 2 → discovered scope
  • [x] Repo — present: forgejo_admin/pal-e-platform
  • [x] User Story — present, well-formed As/I want/So that
  • [x] Context — present, thorough background on DERP hairpin class
  • [x] File Targets — present, includes both modify and do-not-touch guidance
  • [x] Acceptance Criteria — present, 3 criteria
  • [x] Test Expectations — present, includes -lock=false per convention
  • [x] Constraints — present, references existing pattern
  • [x] Checklist — present
  • [x] Related — present, links to parent plan, sibling issues, and same-class bug
  • [x] Extra: Type section (not in template, harmless addition)

File Targets

  • [x] terraform/network-policies.tf — verified: file exists, netpol_minio resource at line 97, current ingress list has 5 entries (tailscale, postgres, woodpecker, monitoring, tofu-state). Pattern uses kubernetes.io/metadata.name namespace selector — adding pal-e-mail follows the identical pattern.
Note: File has uncommitted changes on current branch (ArgoCD rule added to netpol_forgejo). Agent should work on a clean branch from main.

Repo Placement

Correct. Network policies are managed in pal-e-platform. The Context section mentions PAL_E_MAIL_MINIO_CDN_BASE_URL override (lives in pal-e-deployments/overlays/pal-e-mail/prod/deployment-patch.yaml), but File Targets correctly excludes it — that is a separate repo and separate concern. Currently set to external Tailscale URL (https://minio-api.tail5b443a.ts.net/assets/email-templates); switching to internal URL is a follow-up in pal-e-deployments, not this ticket.

Dependencies

  • pal-e-mail namespace — verified active in cluster (8h old). No Terraform resource needed in pal-e-platform (namespace managed externally).
  • Issue #143 (ArgoCD DERP hairpin) — open, same class of bug. Not a blocker for this ticket; they are independent fixes.
  • No board items block this work. Board item #284 is in todo column, no depends: labels.

Acceptance Criteria

All three criteria are agent-verifiable:
  • pal-e-mail namespace reaching MinIO — verifiable post-apply with kubectl exec curl test
  • tofu plan showing only MinIO netpol change — verifiable by inspecting plan output
  • tofu validate passing — verifiable by running the command
Test commands are real and include -lock=false per platform convention. No missing criteria.

Blast Radius

Minimal. Adding one namespace selector to one network policy. No other netpols affected. Checked all 9 existing network policies — no other services need pal-e-mail ingress. No downstream consumers impacted.
The CDN URL override (Context mention) is correctly deferred — it affects pal-e-deployments, not this repo. If the agent gets confused by the Context paragraph about PAL_E_MAIL_MINIO_CDN_BASE_URL, it could try to modify files outside scope. However, the File Targets section is explicit about what to touch and what not to touch, which mitigates this.

Recommendation

No action needed. Ticket is ready for agent execution. One-line change following an established pattern, well-scoped to a single file, all acceptance criteria are machine-verifiable.