pal-e-docs

Review: NetworkPolicy update in pal-e-platform

review-595-2026-03-28 Review

review needs-refinement
Project

Verdict: NEEDS_REFINEMENT

Template Completeness

  • [x] Type — Feature
  • [x] Lineage — Standalone, scoped from westside-ai-assistant design spec (2026-03-28)
  • [x] Repo — forgejo_admin/pal-e-platform
  • [x] User Story — As Marcus (admin), wants AI assistant to reach basketball-api and keycloak
  • [x] Context — Explains NetworkPolicy cross-namespace restriction and connection refused symptom
  • [x] File Targets — terraform/network-policies.tf specified with modify/don't-touch lists
  • [x] Acceptance Criteria — 4 items
  • [x] Test Expectations — tofu validate + tofu plan -lock=false
  • [x] Constraints — Only modify network-policies.tf, follow existing pattern, no tofu apply
  • [x] Checklist — PR opened, plan output, no unrelated changes
  • [x] Related — project-westside-ai-assistant, service-onboarding-sop
All required sections present. Template is structurally complete.

Traceability

  • [x] story:read-ops — AI assistant reads data from basketball-api
  • [x] story:write-ops — AI assistant writes data via basketball-api
  • [x] arch:A4 — infrastructure/platform component
  • [x] Forgejo issue — forgejo_admin/westside-ai-assistant#3, open
Traceability triangle is complete.

File Targets

  • [x] terraform/network-policies.tf — verified: file exists at /home/ldraney/pal-e-platform/terraform/network-policies.tf, contains 9 NetworkPolicy resources for platform namespaces (monitoring, forgejo, woodpecker, harbor, minio, keycloak, postgres, ollama, cnpg-system)
  • [ ] "basketball-api ingress policy" — DOES NOT EXIST. There is no netpol_basketball_api resource in this file. basketball-api is an application namespace, not a platform namespace. It has no default-deny ingress policy anywhere in pal-e-platform, pal-e-services, or pal-e-deployments. Traffic to basketball-api is already unrestricted by default.
  • [x] "keycloak ingress policy" — verified: kubernetes_manifest.netpol_keycloak exists (line 133). Currently allows ingress from tailscale, basketball-api, and monitoring. Adding westside-ai-assistant here is valid and follows the existing pattern.
File targets are partially incorrect. The issue assumes a basketball-api NetworkPolicy exists when it does not.

Repo Placement

Cross-repo filing: Forgejo issue is on forgejo_admin/westside-ai-assistant but work targets forgejo_admin/pal-e-platform. The ### Repo section correctly identifies the target repo. This is acceptable — the issue is scoped from the westside-ai-assistant project and the PR will be opened on pal-e-platform. No multi-repo split needed for the corrected scope (keycloak policy only).

Dependencies

  • [x] Board item #593 (Provision infrastructure in pal-e-services) — logically runs first to create the westside-ai-assistant namespace. However, NetworkPolicy namespace selectors are declarative (label-based), so the policy can reference a namespace that doesn't exist yet. No hard blocker, but logical ordering should be documented.
  • [x] Board item #594 (Create kustomize overlay in pal-e-deployments) — independent, no dependency.
No unresolved blockers. Dependencies are not documented in the issue body but are soft (no execution blocker).

Acceptance Criteria

  • AC1: "westside-ai-assistant namespace listed in basketball-api NetworkPolicy allowlist" — UNTESTABLE. No basketball-api NetworkPolicy exists. Agent cannot satisfy this criterion. Must be removed or rewritten.
  • AC2: "westside-ai-assistant namespace listed in keycloak NetworkPolicy allowlist" — Testable. Agent adds a namespaceSelector line to netpol_keycloak ingress list following existing pattern.
  • AC3: "tofu plan -lock=false shows only NetworkPolicy changes" — Testable. Agent runs cd terraform && tofu plan -lock=false and includes output in PR.
  • AC4: "No other namespaces added or removed" — Testable via plan diff inspection.
3 of 4 AC are testable. AC1 must be corrected.

Blast Radius

  • 1 file touched: terraform/network-policies.tf
  • 1 resource modified: kubernetes_manifest.netpol_keycloak
  • Impact if buggy: worst case, keycloak ingress policy syntax error blocks all keycloak traffic. Rollback is straightforward (revert the single line addition).
  • No similar gap elsewhere — basketball-api has no default-deny policy, so no parallel fix needed. If defense-in-depth is desired for basketball-api, that is a separate scope decision.
  • westside-app (westsidekingsandqueens) already reaches basketball-api without any NetworkPolicy entry, confirming basketball-api is open.

Decomposition Assessment

  • Discrete changes: 1 (add one namespaceSelector line to keycloak policy). Well under the 3-change limit.
  • Estimated agent time: ~2 minutes. Well under the 5-minute rule.
  • No independent subtasks to parallelize.
  • No decomposition needed once scope is corrected.

Recommendation

  • [BODY] Remove reference to "basketball-api ingress policy" from File Targets. Replace with: terraform/network-policies.tf — add westside-ai-assistant namespace to keycloak ingress policy (kubernetes_manifest.netpol_keycloak, line ~148).
  • [BODY] Remove AC1 ("westside-ai-assistant namespace listed in basketball-api NetworkPolicy allowlist"). Replace with: "basketball-api has no default-deny ingress policy — no change needed for basketball-api connectivity."
  • [BODY] Update Context to clarify: only the keycloak policy needs modification. basketball-api is already reachable from any namespace.
  • [SCOPE] Decision needed: should a default-deny NetworkPolicy be created for basketball-api? If yes, that is a separate ticket. Currently basketball-api accepts ingress from all namespaces (no defense-in-depth).