pal-e-docs

Review: Bug: ArgoCD stale app

review-452-2026-03-27 Review

review needs-refinement
Project

Verdict: NEEDS_REFINEMENT

Template Completeness

  • [x] Type
  • [x] Lineage
  • [x] Repo
  • [x] What Broke
  • [x] Repro Steps
  • [x] Expected Behavior
  • [x] Environment
  • [x] Acceptance Criteria
  • [x] Related
  • [x] File Targets
  • [x] Test Expectations
  • [x] Constraints
All required bug template sections are present. Extra sections (User Story, Context) are helpful bonus.

Traceability

  • [x] story:superuser-deploy label — superuser deploy story
  • [x] arch:k8s-deploy label — k8s deployment architecture component
  • [x] Forgejo issue — forgejo_admin/pal-e-platform#203, open
Traceability triangle complete.

File Targets

  • [x] pal-e-services/terraform/services.tf — verified: file exists, ArgoCD app resource at lines 123-169. Uses coalesce(each.value.source_repo, each.value.forgejo_repo) on line 148 and coalesce(each.value.source_path, "k8s") on line 149. Already uses internal URL.
  • [x] pal-e-services/terraform/k3s.tfvars — verified: file exists, all 9 services already have source_repo = "forgejo_admin/pal-e-deployments" and correct source_path = "overlays/{service}/prod".
Critical finding: The Terraform code is already correct. The issue says "tofu apply hasn't been run to update the ArgoCD apps since the migration." This is an apply-only fix, not a code change. An agent would find nothing to PR.

Repo Placement

MISMATCH: Issue filed on forgejo_admin/pal-e-platform but both file targets are in forgejo_admin/pal-e-services. An agent dispatched to pal-e-platform would not find these files.

Dependencies

  • BLOCKER — Board item #460 (pal-e-services#36, todo): "ArgoCD repo_url :80 port mismatch" modifies the SAME line (services.tf line 148). The :80 port must be removed before tofu apply succeeds. Issue #203 is blocked by #36.
  • main.tf line 320: argocd_repository_credentials.forgejo also uses :80, creating a credential mismatch. Covered by pal-e-services#36 but not mentioned in #203.
  • Board item #447 (issue #200, done): Tailscale hairpin elimination — completed.
  • Board item #448 (issue #201, done): Migrate all apps to pal-e-deployments — completed (tfvars updated, live state not).
  • Board item #332 (issue #143, done): Original internal URL migration — completed but ArgoCD apps not updated in that pass.

Acceptance Criteria

Criteria are testable but assume code changes will appear in tofu plan. Since the code is already correct, plan may show no changes or only the port fix from #36. The "image tag update triggers sync" criterion requires an actual push to verify.

Blast Radius

  • All 9 services affected simultaneously — a failed apply could break ArgoCD sync for all apps.
  • argocd-image-updater annotations use write-back-method = "git:secret:argocd/git-creds" — credential alignment needed if repo URL format changes.

Recommendation

  • Resolve overlap with pal-e-services#36 — Issues #203 and #36 target the same line and same outcome. Either merge them or mark #203 as blocked-by #36 with a depends:pal-e-services-36 label.
  • Move or refile on correct repo — The issue is on pal-e-platform but the fix is in pal-e-services.
  • Clarify deliverable — If the fix is "run tofu apply," that is an operational task, not a code PR. The ticket as written would dispatch an agent that finds nothing to change.
  • Add :80 port fix to scope or depend on #36 — Without fixing the :80 mismatch in services.tf and main.tf, tofu apply will fail with SOPS CMP EOF errors.