Review: NetworkPolicy update in pal-e-platform (re-review)

Verdict: READY

Template Completeness

• [x] Type — Feature
• [x] Lineage — Standalone, scoped from westside-ai-assistant design spec (2026-03-28)
• [x] Repo — forgejo_admin/pal-e-platform
• [x] User Story — As Marcus (admin), wants AI assistant to reach Keycloak for client credentials flow
• [x] Context — Clearly explains that only keycloak NetworkPolicy needs modification; basketball-api has no NetworkPolicy and is already reachable
• [x] File Targets — terraform/network-policies.tf with modify/don't-touch lists; correctly scoped to keycloak only
• [x] Acceptance Criteria — 4 items, all keycloak-scoped
• [x] Test Expectations — tofu validate + tofu plan -lock=false
• [x] Constraints — Only modify keycloak policy, follow existing pattern, no tofu apply, no new NetworkPolicy resources
• [x] Checklist — PR opened, plan output, no unrelated changes
• [x] Related — project-westside-ai-assistant, service-onboarding-sop

Traceability

• [x] story:read-ops — AI assistant reads data (needs Keycloak token)
• [x] story:write-ops — AI assistant writes data (needs Keycloak token)
• [x] arch:A4 — infrastructure/platform component
• [x] Forgejo issue — forgejo_admin/westside-ai-assistant#3, open

File Targets

• [x] terraform/network-policies.tf — verified: file exists at /home/ldraney/pal-e-platform/terraform/network-policies.tf (221 lines), contains 9 NetworkPolicy resources
• [x] kubernetes_manifest.netpol_keycloak — verified: exists at lines 133-154. Currently allows ingress from tailscale (line 148), basketball-api (line 149), and monitoring (line 150)
• [x] Pattern reference — verified: basketball-api entry at line 149 is the exact pattern to replicate: { from = [{ namespaceSelector = { matchLabels = { "kubernetes.io/metadata.name" = "basketball-api" } } }] },
• [x] "Files the agent should NOT touch" — correctly lists all other terraform files and explicitly forbids creating a basketball-api NetworkPolicy

Repo Placement

Dependencies

• Board item #593 (Provision infrastructure in pal-e-services) — logically runs first to create the westside-ai-assistant namespace, but NetworkPolicy namespaceSelector is declarative (label-based). The policy can reference a namespace that doesn't exist yet. No hard blocker.
• Board item #594 (Create kustomize overlay in pal-e-deployments) — independent, no dependency.
• Board item #605 (Discovered: basketball-api default-deny NetworkPolicy) — tracked as separate discovered scope. No dependency on this ticket.

Acceptance Criteria

• AC1: "westside-ai-assistant namespace listed in keycloak NetworkPolicy namespaceSelector" — Testable. Agent adds one line to the ingress list.
• AC2: "tofu plan -lock=false shows only the keycloak NetworkPolicy change" — Testable. Agent runs command and includes output in PR.
• AC3: "No other namespaces added or removed" — Testable via plan diff inspection.
• AC4: "No new NetworkPolicy resources created" — Testable via plan diff inspection.

Blast Radius

• 1 file touched: terraform/network-policies.tf
• 1 resource modified: kubernetes_manifest.netpol_keycloak
• 1 line added (namespaceSelector entry)
• Impact if buggy: worst case, keycloak ingress policy syntax error blocks all keycloak traffic. Rollback is a single-line revert.
• No westside-ai-assistant references exist anywhere in pal-e-platform today (confirmed via grep). This is a clean addition.
• Discovered scope (basketball-api default-deny) tracked separately as board item #605 / Forgejo issue #9.

Decomposition Assessment

• File targets: 1 file, 1 resource, 1 line addition
• Acceptance criteria: 4 (under the 5 threshold)
• Estimated agent time: ~2 minutes
• No independent subtasks to parallelize

Previous Review Resolution

• [x] [BODY] "Remove basketball-api ingress policy from File Targets" — RESOLVED. File Targets now reference only keycloak policy. "Files the agent should NOT touch" explicitly says not to create a basketball-api NetworkPolicy.
• [x] [BODY] "Remove AC1 referencing basketball-api allowlist" — RESOLVED. All AC are keycloak-scoped.
• [x] [BODY] "Update Context to clarify only keycloak needs modification" — RESOLVED. Context now states: "basketball-api does NOT have a NetworkPolicy... Only the keycloak NetworkPolicy needs modification."
• [x] [SCOPE] "Decision needed on basketball-api default-deny" — RESOLVED. Tracked as discovered scope: board item #605, Forgejo issue #9.

Recommendation