pal-e-docs

Review: Fix westside-app pod CreateContainerConfigError (missing secrets)

review-612-2026-03-28 Doc

review needs-refinement
Project

Verdict: NEEDS_REFINEMENT

Template Completeness

Issue ### Type says "Feature" but board item label says type:bug and title says "Fix:". This is a bug (missing secrets causing pod crash). The issue body uses the Feature template structure, not the Bug template.
  • [ ] Type — present but wrong value (says Feature, should say Bug)
  • [x] Lineage — present, references board and story
  • [x] Repo — present, lists both westside-landing and pal-e-deployments
  • [x] User Story — present, clear operator need
  • [x] Context — present, describes root cause well
  • [ ] File Targets — present but contains errors (wrong path, non-file entry)
  • [x] Acceptance Criteria — present, 4 testable items
  • [x] Test Expectations — present, 3 verification commands
  • [x] Constraints — present, 3 clear constraints
  • [x] Checklist — present, 5 steps
  • [x] Related — present, links to Harbor incident and live URL
Bug template sections missing (if type were corrected): What Broke, Repro Steps, Expected Behavior, Environment. The existing Context section covers the "What Broke" content adequately, but the template structure doesn't match.

Traceability

  • [x] story:WS-S3 — present on board item
  • [x] arch:k8s-deploy — present on board item
  • [x] Forgejo issue — forgejo_admin/westside-landing#149, open

File Targets

  • [ ] pal-e-deployments/overlays/westside-app/ — ISSUE: path does not exist. Correct path is ~/pal-e-deployments/overlays/westsidekingsandqueens/prod/. Verified: deployment-patch.yaml there references westside-app-auth secret with keys: auth-secret, keycloak-client-id, keycloak-client-secret, keycloak-admin-password. Also contains harbor-creds.enc.yaml (SOPS-encrypted).
  • [ ] "Keycloak admin console" — not a file path. This is an operational step and should be in Constraints or Checklist, not File Targets.
  • [x] ~/secrets/ — verified: directory exists. Contains no westside-specific or keycloak-specific credential files. Search for ~/secrets/westside* and ~/secrets/keycloak* returned nothing.
Missing from file targets: pal-e-deployments/overlays/westsidekingsandqueens/prod/harbor-creds.enc.yaml — the SOPS-encrypted harbor pull secret already exists in the overlay. The issue says harbor-creds needs to be created in-cluster, but doesn't reference this existing encrypted manifest or clarify whether ArgoCD SOPS handles this automatically.

Repo Placement

Issue is filed on forgejo_admin/westside-landing but no code changes are needed in that repo. The fix is entirely operational: creating k8s secrets in the default namespace. The kustomize overlay in pal-e-deployments already has the correct secret references and an encrypted harbor-creds.enc.yaml. Filing on westside-landing as the "affected service" is acceptable, but should be explicit that the fix touches zero files in that repo.

Dependencies

  • [x] Board items #588, #589, #590 (backlog) — rename westside-app to westside-landing across terraform, ArgoCD, and blackbox probes. NOT blocking this fix, but explain why overlay path is westsidekingsandqueens not westside-app.
  • [ ] ArgoCD SOPS decryption — the overlay includes harbor-creds.enc.yaml. If ArgoCD decrypts SOPS secrets on sync, harbor-creds may already exist or will be created automatically. This dependency is not documented in the issue and could mean manual harbor-creds creation is redundant or conflicts with ArgoCD.

Acceptance Criteria

4 AC, all verifiable via kubectl and curl. Clear and testable. Two gaps:
  • Missing: verification that secret values are correct (not just that the secret exists). A secret with wrong credentials would make the pod Running but auth would fail at runtime.
  • The curl check (AC #4) partially covers this if the app validates Keycloak credentials on startup, but this assumption should be explicit.

Blast Radius

  • harbor-creds pull secret pattern is used by all 10 service overlays. If harbor-creds is missing in default namespace, any pod restart in that namespace would fail to pull new images. The issue notes the image is already on the node, so this is a latent risk rather than an active blocker for other services.
  • westside-app-auth secret is unique to this deployment. No other services reference it. No blast radius.
  • Rollback: trivial — deleting a secret doesn't break anything worse than the current state (pod already crashed).

Decomposition Assessment

4 AC, 1-2 effective targets (kubectl secret creation + verification), single namespace, no code changes. Estimated agent time: under 3 minutes. Fits the five-minute rule. Under 3 discrete changes (create westside-app-auth, verify harbor-creds, confirm pod starts). No decomposition needed.

Recommendation

  • [BODY] Change ### Type from "Feature" to "Bug"
  • [BODY] Fix file path: pal-e-deployments/overlays/westside-app/ to pal-e-deployments/overlays/westsidekingsandqueens/prod/
  • [BODY] Remove "Keycloak admin console" from File Targets (it is an operational step, not a file path)
  • [BODY] Add reference to existing harbor-creds.enc.yaml in overlay — clarify whether ArgoCD SOPS handles this or manual kubectl create secret is needed
  • [BODY] Add AC: "App authenticates with Keycloak successfully (not just pod Running)" or note that the curl 200 check covers this
  • [BODY] Add ### Environment: default namespace, image tag c66ea898, overlay path westsidekingsandqueens/prod