Review: Add argocd namespace to Forgejo network policy

Verdict: READY

Template Completeness

• [x] Type — Bug
• [x] Lineage — References #184 (parent incident), #143 (pal-e-services, closed, completed URL migration)
• [x] Repo — forgejo_admin/pal-e-platform
• [x] What Broke — Clear: ArgoCD pods can't reach Forgejo internal service due to missing netpol entry. Explicit "Already done (not in scope)" section prevents duplicate work.
• [x] Repro Steps — curl command from argocd pod, before/after
• [x] Expected Behavior — ArgoCD pods reach Forgejo internal service
• [x] Environment — File path, line numbers, namespace all specified
• [x] File Targets — Single target: terraform/network-policies.tf. Explicit "Files NOT to touch" section.
• [x] Acceptance Criteria — 5 criteria, all actionable
• [x] Test Expectations — tofu validate, plan, post-deploy kubectl check
• [x] Constraints — lock=false, existing pattern, #196/#197 blocker noted
• [x] Checklist
• [x] Related — #143, #184, #196, #197, project page

Traceability

• [x] story:superuser-deploy label — on board item
• [x] story:platform-reliability label — on board item
• [x] arch:argocd label — on board item
• [x] arch:tailscale-funnel label — on board item
• [x] Forgejo issue — #200, open

File Targets

• [x] terraform/network-policies.tf lines 34-56 — VERIFIED: Forgejo netpol exists, current allow list is tailscale, woodpecker, monitoring. No argocd entry present. Adding argocd follows the established pattern.
• [x] "Files NOT to touch" section — VERIFIED: terraform/main.tf does not contain ArgoCD Application resources (they are in pal-e-services). Issue correctly excludes it.
• [x] Harbor netpol already has argocd (line 102) — VERIFIED: confirmed in codebase. Issue correctly states this is not in scope.

Repo Placement

Dependencies

• #197 (Terraform state splitting) — in_progress on board (item #436). Issue notes this as a potential blocker. Since the change is in network-policies.tf (not main.tf), the dependency is weaker but still relevant if #197 restructures file layout. Documented in Constraints section.
• #196 (tofu apply blocked by MinIO) — backlog on board (item #435). Could block applying any changes. Documented in Constraints section.
• #184 (parent incident) — in_progress on board (item #411). This ticket was scoped from that investigation. Documented in Lineage.
• #143 (ArgoCD internal Forgejo URL) — closed in pal-e-services. Completed the URL migration. Documented in Lineage and "Already done" section.

Acceptance Criteria

• "Forgejo network policy includes argocd namespace" — verifiable via tofu plan output or file diff
• "tofu plan shows only the network policy change" — verifiable by running tofu plan
• "ArgoCD syncs all apps without EOF errors" — verifiable via kubectl post-deploy
• "Image updater successfully queries Harbor tags" — verifiable via pod logs post-deploy
• "kubectl band-aid patches superseded" — verifiable by confirming Terraform manages the policy

Blast Radius

• Adding a namespace to the Forgejo netpol ingress allow list is a well-established pattern — same as tailscale, woodpecker, monitoring entries already present.
• Harbor netpol already allows argocd (line 102), so no additional change needed there.
• No other services appear to need argocd access to Forgejo.
• Low risk. One-line change following existing pattern.

Recommendation

• Scope reduced to single network policy change — done
• File targets corrected to network-policies.tf only — done
• Acceptance criteria reduced to actionable items — done (8 to 5)
• #143 overlap acknowledged in Lineage — done
• Title updated to match actual scope — done
• Band-aid revert criterion added — done