pal-e-docs

Review: Fix prod pod -> playme2k.tail5b443a.ts.net live

review-825-2026-04-03 Review

review needs-refinement
Project

Verdict: NEEDS_REFINEMENT

Template Completeness

  • [x] Type -- Bug
  • [x] Lineage -- present, describes production blocker
  • [x] Repo -- present (pal-e-deployments + pal-e-services)
  • [x] What Broke -- present, describes ImagePullBackOff / CreateContainerConfigError
  • [x] Repro Steps -- present, kubectl + URL check
  • [x] Expected Behavior -- present
  • [x] Environment -- present (playme2k namespace, prod overlay, ArgoCD-managed)
  • [x] File Targets -- present (3 targets listed)
  • [x] Acceptance Criteria -- present, 4 criteria
  • [x] Test Expectations -- present
  • [x] Constraints -- present
  • [x] Checklist -- present
  • [x] Related -- present, references #3 and #22
All required bug template sections present.

Traceability

  • [x] story:challenger-pay label -- Secure Buy-In Payment
  • [x] story note verified -- found in project-twitch-2k-wager user-stories table (key: challenger-pay, note: story-twitch-2k-wager-challenger-pay, id 1158)
  • [x] arch:deployment-twitch-2k-wager label -- Deployment architecture
  • [x] arch note verified -- arch-deployment-twitch-2k-wager exists (id 1156, status active)
  • [x] Forgejo issue -- forgejo_admin/twitch-2k-wager#56, state: open

File Targets

  • [ ] pal-e-deployments/overlays/twitch-2k-wager/prod/harbor-creds.enc.yaml -- ISSUE: Directory does not exist. No twitch-2k-wager overlay directory exists in pal-e-deployments. Existing overlays: basketball-api, gcal-scheduler, mcd-tracker, mcd-tracker-app, pal-e-docs, pal-e-mail, pal-e-production, platform-validation, playground, svelte-playground, westside-ai-assistant, westsidekingsandqueens. The kustomize overlay (board item #788, issue #3) has not been created yet.
  • [ ] twitch-2k-wager-secrets key names vs deployment-patch.yaml -- Cannot verify: overlay does not exist, so no deployment-patch.yaml to check secretKeyRef entries against.
  • [ ] ArgoCD app sync -- No ArgoCD application found for playme2k/twitch-2k-wager. Resources appear to have been applied manually (kubectl apply), not via GitOps.

Repo Placement

MISMATCH. Issue is filed on forgejo_admin/twitch-2k-wager but the fix targets pal-e-deployments (kustomize overlay) and pal-e-services (terraform). The issue body correctly identifies these repos in the Repo section, but the Forgejo issue should be filed on pal-e-deployments since that is the primary repo where changes land. Since the overlay does not exist yet, this work may actually be a prerequisite completion of issue #3 (Kustomize overlay) rather than a standalone bug fix.

Dependencies

  • Issue #37 (Fix: prod pod ImagePullBackOff -- Harbor creds) -- still open, overlaps significantly with this issue. Both address the same pod startup failure. #37 focuses on Harbor creds, #56 adds secrets alignment. Pod is now running, so #37 may be resolvable as duplicate/already-fixed.
  • Board item #788 (Kustomize overlay, issue #3) -- in needs_approval column. The overlay directory this issue targets does not exist. This ticket implicitly depends on the overlay being created first.
  • Board item #826 (Observability: blackbox probe + golden signals, issue #57) -- in backlog. Depends on this ticket (cannot probe a site that is not serving).
  • Funnel ingress service name mismatch -- NOT documented in scope. The playme2k-funnel ingress backend points to service name playme2k but the actual service is named twitch-2k-wager (port 3000). Tailscale operator error: failed to get service "playme2k" for path "/": Service "playme2k" not found. This is the actual blocker preventing the URL from resolving and is not mentioned in the issue body.

Acceptance Criteria

  • "Prod pod running (1/1 Ready)" -- ALREADY MET. Pod twitch-2k-wager-7c78c96dc6-mtdlq is 1/1 Ready. Image: harbor.tail5b443a.ts.net/playme2k/app:d4d758f6...
  • "Image pulled from harbor.tail5b443a.ts.net/playme2k/app" -- ALREADY MET.
  • "https://playme2k.tail5b443a.ts.net/play returns 200" -- NOT MET. HTTP 000 (connection refused). Root cause: funnel ingress backend references non-existent service name playme2k instead of twitch-2k-wager.
  • "https://playme2k.tail5b443a.ts.net/admin?secret=... shows queue" -- NOT MET. Same root cause as above.
AC 1-2 are already resolved (pod is running and pulling from Harbor). AC 3-4 require fixing the funnel ingress to reference the correct service name. The issue body does not identify this root cause.

Blast Radius

Low. The funnel service name mismatch is isolated to the playme2k namespace. Other services use correct service names in their funnel ingress configs. No downstream consumers affected beyond this project. Rollback is straightforward (kubectl patch or delete/recreate ingress).

Decomposition Assessment

No decomposition needed. Once correctly scoped, this is a single change: fix the funnel ingress backend service name from playme2k to twitch-2k-wager. One file target, 2 remaining AC, well under 5 minutes for a single agent. No independent subtasks to parallelize.

Recommendation

  • [BODY] Update "What Broke" to identify the actual remaining blocker: funnel ingress backend references service playme2k but actual service is named twitch-2k-wager. The ImagePullBackOff and secrets issues appear already resolved.
  • [BODY] Update file targets: the overlay directory pal-e-deployments/overlays/twitch-2k-wager/ does not exist. Either this ticket depends on #3 (overlay creation) completing first, or the fix is a kubectl patch to the existing manually-applied ingress plus a corresponding update to wherever the funnel is defined in Terraform (pal-e-services).
  • [BODY] Add file target: the funnel ingress resource needs spec.defaultBackend.service.name changed from playme2k to twitch-2k-wager.
  • [BODY] Update AC: Mark AC 1-2 as already passing. Focus remaining AC on the funnel routing fix.
  • [BODY] Document the dependency on issue #3 (kustomize overlay) or clarify that this fix will be applied via kubectl/Terraform and the overlay comes later.
  • [SCOPE] Consolidate or close issue #37 (ImagePullBackOff) -- the pod is now running and pulling images successfully.