pal-e-docs

Review: ArgoCD apps point to wrong source repos + external Forgejo URLs

review-452-2026-03-26 Review

review needs-refinement
Project

Verdict: NEEDS_REFINEMENT

Template Completeness

  • [x] Type -- Bug
  • [x] Lineage -- Standalone, discovered during westside-app deployment
  • [x] Repo -- forgejo_admin/pal-e-platform
  • [x] What Broke -- ArgoCD apps point to wrong source repos + external URLs
  • [x] Repro Steps -- kubectl commands provided
  • [x] Expected Behavior -- internal URL + pal-e-deployments repo
  • [x] Environment -- argocd namespace, all apps affected
  • [x] Acceptance Criteria -- 4 criteria listed
  • [x] Related -- references #143 and project-pal-e-platform
  • [x] User Story (bonus) -- superadmin deploy story
  • [x] Context (bonus) -- explains root cause
  • [x] File Targets (bonus) -- lists modify and don't-touch files
  • [x] Test Expectations (bonus) -- kubectl validation commands
  • [x] Constraints (bonus) -- tofu plan lock, non-destructive
All required bug template sections present. Issue is overcomplete (includes feature-template sections).

Traceability

  • [x] story:superuser-deploy label -- superadmin deployment story
  • [x] arch:k8s-deploy label -- k8s deployment architecture component
  • [x] Forgejo issue -- forgejo_admin/pal-e-platform#203, open
Traceability triangle is complete.

File Targets

  • [x] pal-e-services/terraform/services.tf -- verified exists. Line 148 already uses internal URL: http://forgejo-http.forgejo.svc.cluster.local:80/. Line 149 already uses coalesce(each.value.source_path, "k8s").
  • [x] pal-e-services/terraform/k3s.tfvars -- verified exists. All 9 services already have source_repo = "forgejo_admin/pal-e-deployments" and correct source_path = "overlays/{service}/prod".
  • [ ] ISSUE: Both files already contain the correct values. Zero external Forgejo URLs exist in any .tf file. The "bug" is that tofu apply has not been run to push the current Terraform state to the cluster. This is an apply task, not a code change.

Repo Placement

MISMATCH: Issue is filed on forgejo_admin/pal-e-platform but both file targets are in pal-e-services/terraform/. The issue itself states "ArgoCD is managed by pal-e-services." If the fix is purely tofu apply on pal-e-services state, the issue should be on pal-e-services. However, if this is intentionally a platform-level operational issue (run apply), the current placement is acceptable -- but an agent will look in the wrong repo for code to modify.

Dependencies

  • #196 (open, backlog) -- "tofu apply blocked by MinIO provider refresh." If apply is the fix for #203, then #196 is a blocker. Not documented in the issue.
  • #197 (open, in_progress) -- "Terraform state splitting." Active restructuring of the Terraform state. Running apply on monolithic state while splitting is in progress risks conflict. Not documented.
  • #200 (closed) -- "Eliminate Tailscale hairpin -- ArgoCD + image updater internal URLs." Significant scope overlap. #200 was about adding ArgoCD to the Forgejo network policy so internal URLs work. If #200 is done, the network path is clear -- but #203 may already be resolved by that same work. Needs verification.
  • #143 (closed, done on board) -- "ArgoCD: switch all apps to internal Forgejo URL." The issue acknowledges this was "incomplete" but the code already has all correct values. What exactly is incomplete?

Acceptance Criteria

  • [x] "All ArgoCD apps point to pal-e-deployments repo" -- verifiable via kubectl, command provided
  • [x] "All ArgoCD apps use internal Forgejo URL" -- verifiable via kubectl
  • [x] "kubectl get application shows Synced" -- verifiable, command provided
  • [ ] "Image tag update triggers automatic ArgoCD sync" -- verifiable but requires end-to-end test (push image, wait for sync). No test command provided for this criterion.
Criteria are mostly testable. The fourth criterion needs a concrete test procedure.

Blast Radius

All 9 ArgoCD apps are created from the same for_each loop in services.tf. A tofu apply would update all apps simultaneously. The issue correctly identifies "all apps affected." No hidden blast radius beyond what is documented. However, if any service has divergent cluster state (manual kubectl edits), apply could cause unexpected reconciliation.

Recommendation

Before this ticket is READY, the following must be addressed:
  • Clarify the actual work -- The Terraform code already has the correct values. Is this ticket just "run tofu apply"? If so, the file targets section is misleading (says "modify" but nothing needs modifying). Rephrase to "verify and apply."
  • Document dependency on #196 -- If tofu apply is blocked by MinIO provider refresh, this ticket is blocked too. Add a depends label or note.
  • Document dependency on #197 -- State splitting is actively in progress. Clarify whether this apply should happen before or after the split.
  • Verify #200 didn't already fix this -- Issue #200 (network policy fix) may have resolved the EOF errors. Run the repro steps to confirm the bug still exists before assigning an agent.
  • Repo placement -- Consider moving to pal-e-services if the work is purely an apply there, or clarify that this is a cross-repo operational task coordinated from pal-e-platform.