pal-e-docs

Review: Remove non-functional gRPC funnel

review-401-2026-03-27 Review

review ready
Project

Verdict: READY

Template Completeness

  • [x] Type — Bug
  • [x] Lineage — standalone, discovered during Mac agent setup (#174)
  • [x] Repo — forgejo_admin/pal-e-platform
  • [x] What Broke — gRPC funnel terminates TLS as HTTP/1.1, breaks HTTP/2 binary framing
  • [x] Repro Steps — kubectl get pods, kubectl logs, confirms unused
  • [x] Expected Behavior — no non-functional infrastructure running
  • [x] Environment — resource name + namespace identified
  • [x] Acceptance Criteria — 4 criteria, all verifiable
  • [x] Related — references #173 (origin) and #175 (replacement)

Traceability

  • [ ] story:X label — missing. Acceptable: this is foundational cleanup of dead infrastructure, not user-facing.
  • [x] arch:ci-pipeline label — present on board item #401
  • [x] Forgejo issue — #182, open

File Targets

  • [x] terraform/modules/networking/main.tf:259-286 — verified: kubernetes_ingress_v1.woodpecker_grpc_funnel resource exists at lines 259-286, proxies port 9000 with funnel annotation, hostname "woodpecker-grpc"
  • [x] terraform/main.tf:174-177 — verified: moved block exists that relocated this resource from root to networking module. Must also be removed.
Note: The issue body references the resource path as terraform/main.tf which was accurate pre-modularization. The resource now lives in terraform/modules/networking/main.tf after the state splitting (#197). The moved block in terraform/main.tf also needs removal. Agent must target both files.

Repo Placement

OK — issue filed on pal-e-platform, resource lives in pal-e-platform. Single-repo fix.

Dependencies

  • Board item #394 (Tailscale Connector — k8s subnet router, issue #175) — done. This is the replacement mechanism. No blocker.
  • Board item #411 (Harbor connectivity timeout, issue #184) — in_progress. Unrelated to funnel removal.
  • No items blocked by this ticket.
  • No items blocking this ticket.

Acceptance Criteria

  • [x] "woodpecker_grpc_funnel resource removed from terraform/main.tf" — verifiable via grep after PR. Note: ticket says main.tf but actual target is modules/networking/main.tf + moved block in main.tf.
  • [x] "tofu apply destroys the funnel pod" — verifiable via CI apply output
  • [x] "No woodpecker-grpc node in tailscale status" — verifiable post-apply
  • [x] "Mac agent still connected (uses subnet router, not funnel)" — verifiable via Woodpecker UI or kubectl
All 4 criteria are machine-verifiable. The first criterion's file path is slightly stale (see File Targets note above) but the intent is clear.

Blast Radius

  • Tailscale ACL uses blanket autogroup:member + tag:k8s → funnel policy (networking/main.tf:82-86). Removing the ingress resource does not require ACL changes.
  • No Salt states reference woodpecker-grpc.
  • No network policies reference the gRPC funnel.
  • The Woodpecker HTTP funnel (woodpecker_funnel, port 80) is a separate resource and is NOT affected.
  • No other services depend on the woodpecker-grpc hostname.
  • Low blast radius — this is a pure deletion of an isolated, non-functional resource.

Decomposition (5-minute rule)

  • 2 file targets in 1 repo — under threshold
  • 4 acceptance criteria — under threshold
  • Estimated agent work: ~2 minutes (delete resource block + delete moved block + tofu fmt) — under threshold

Recommendation

No action needed — ticket is READY for execution. One minor note for the implementing agent: the issue body says "removed from terraform/main.tf" but the resource was modularized to terraform/modules/networking/main.tf (lines 257-286). The moved block at terraform/main.tf lines 174-177 must also be deleted. Both changes are straightforward deletions.