pal-e-docs

Review: Migrate all apps to pal-e-deployments

review-448-2026-03-26 Review

review ready
Project

Verdict: READY

Re-review after issue body rewrite. All 6 findings from initial NEEDS_REFINEMENT review have been addressed.

Template Completeness

  • [x] Type -- Feature
  • [x] Lineage -- references incident #184, cites initial review
  • [x] Repo -- correctly lists pal-e-deployments (overlay creation) + pal-e-services (tofu apply)
  • [x] User Story -- well-formed platform operator story
  • [x] Context -- accurately states Terraform migration is already done, only overlay creation + apply remain
  • [x] File Targets -- correctly scoped: only pal-e-app overlay files to create, explicit "do NOT touch" list
  • [x] Acceptance Criteria -- 4 items, all verifiable
  • [x] Test Expectations -- 3 items including kubectl command, correctly references pal-e-services for tofu plan
  • [x] Constraints -- ordering (overlay before apply), dependency on #200, tofu -lock=false flag
  • [x] Checklist -- present, matches actual work scope
  • [x] Related -- references #200, #184, project-pal-e-platform

Traceability

  • [x] story:superuser-deploy label -- deployment operator story
  • [x] story:platform-reliability label -- reliability story
  • [x] arch:argocd label -- ArgoCD architecture component
  • [x] arch:kustomize label -- Kustomize architecture component
  • [x] Forgejo issue -- forgejo_admin/pal-e-platform#201, open

File Targets

  • [x] overlays/pal-e-app/prod/kustomization.yaml -- verified: directory does NOT exist (deleted in commit 58efd8b). Needs creation.
  • [x] overlays/pal-e-app/prod/deployment-patch.yaml -- to create. Reference overlay (westsidekingsandqueens) has matching file.
  • [x] overlays/pal-e-app/prod/ingress.yaml -- to create. Reference overlay has matching file.
  • [x] overlays/pal-e-app/prod/harbor-creds.enc.yaml -- to create. Reference overlay has matching file (SOPS-encrypted).
  • [x] "Do NOT touch" list is accurate: pal-e-platform/terraform has no argocd_application resources, k3s.tfvars already correct (all 9 services have source_repo = "forgejo_admin/pal-e-deployments"), services.tf already correct.

Repo Placement

ACCEPTABLE. Issue is filed on pal-e-platform (the platform board), which is correct for cross-repo coordination tickets. The Repo field correctly identifies the two repos where actual work happens: pal-e-deployments (overlay creation) and pal-e-services (tofu apply). No pal-e-platform files are touched.

Dependencies

  • #200 (Eliminate Tailscale hairpin) -- documented in Constraints section. Both #200 and #201 are in todo column. Issue correctly says "do #200 first." ArgoCD needs reliable Forgejo access before switching app sources.
  • #196 (MinIO provider refresh) -- NOT a blocker. #196 affects pal-e-platform applies (MinIO provider timeout). The apply for #201 runs in pal-e-services, which has no MinIO provider dependency. Correctly omitted from the rewritten issue.
  • #197 (Terraform state splitting) -- in in_progress. Not a dependency: #197 splits pal-e-platform, while #201's apply runs in pal-e-services.

Acceptance Criteria

  • [x] "pal-e-app overlay created with proper kustomize image override" -- verifiable by file inspection
  • [x] "tofu apply in pal-e-services succeeds" -- verifiable, correctly references pal-e-services
  • [x] "All 9 apps sync successfully from pal-e-deployments" -- verifiable via kubectl/ArgoCD status
  • [x] "No app breaks during migration (especially pal-e-app)" -- verifiable, blast radius documented
All criteria are testable and correctly scoped.

Blast Radius

  • pal-e-app has NO overlay. The tfvars already points ArgoCD to overlays/pal-e-app/prod which doesn't exist. The issue correctly documents this in Context and Constraints: create overlay BEFORE running tofu apply.
  • State drift is already live. k3s.tfvars has all 9 services pointing to pal-e-deployments, but live cluster state may differ. The apply will reconcile this. All 8 other overlays already exist, so the blast radius is limited to the sequence: overlay creation must precede apply.
  • Image updater write-back. Once apps switch sources, image updater will auto-commit to pal-e-deployments. This is existing behavior for the 8 apps already on pal-e-deployments and is a known/accepted pattern.

Recommendation

No action needed. All 6 findings from the initial review have been addressed:
  • Context section -- now accurately describes remaining work (overlay + apply only)
  • Architecture table -- removed; Context lists which overlays exist vs. missing
  • File Targets -- correctly scoped to pal-e-app overlay files only, with explicit "do NOT touch" list
  • Repo field -- correctly identifies pal-e-deployments + pal-e-services
  • #196 dependency -- correctly omitted (not a blocker for pal-e-services apply)
  • Scope reduction -- issue is now appropriately scoped: 1 overlay + 1 apply

Review History

  • 2026-03-27 initial -- NEEDS_REFINEMENT. 6 findings: wrong repo, outdated context, incorrect file targets, missing overlay acknowledgment, undocumented #196 dependency, oversized scope.
  • 2026-03-27 re-review -- READY. All 6 findings addressed. Issue body rewritten with accurate repo placement, correct file targets, reduced scope. #196 dependency correctly omitted after verification (pal-e-services has no MinIO provider).