pal-e-docs

Review: fix: PlayMe2K kustomize overlay references wrong namespace (twitch-2k-wager vs playme2k)

review-828-2026-04-05 Doc

review ready
Project

Verdict: READY

Re-review after refinement. Issue body now includes explicit file targets, SOPS decrypt/encrypt workflow, and constraints. Blast radius (pal-e-production namespace mismatch) correctly filed as separate issue pal-e-deployments#97. Scope is tight: one encrypted file, one field change, clear acceptance criteria.

Template Completeness

  • [x] Type -- Bug
  • [x] Lineage -- Standalone, discovered during PlayMe2K validation blitz 2026-04-05
  • [x] Repo -- forgejo_admin/pal-e-deployments
  • [x] What Broke -- ArgoCD OutOfSync, namespace mismatch detail, error message included
  • [x] Repro Steps -- 4 steps with kubectl command
  • [x] Expected Behavior -- ArgoCD Synced, correct namespace
  • [x] Environment -- cluster, namespace, ArgoCD app, SOPS age key path
  • [x] File Targets -- explicit path with SOPS workflow included
  • [x] Acceptance Criteria -- 3 criteria, all testable
  • [x] Test Expectations -- kustomize build + decrypt verification
  • [x] Constraints -- SOPS cycle requirement, age key location, single file scope
  • [x] Checklist -- 4 discrete execution steps
  • [x] Related -- project, validation note, related Forgejo issue

Traceability

  • [x] story:superuser-deploy -- verified in project-pal-e-platform user-stories table: "I can deploy infrastructure changes via tofu plan/apply and see them succeed in Woodpecker CI without manual intervention."
  • [x] arch:argocd -- no dedicated arch note in pal-e-docs, but ArgoCD is a well-known platform component and the label correctly identifies the subsystem. Acceptable for discovered-scope bug.
  • [x] arch:k8s-deploy -- no dedicated arch note in pal-e-docs. Same rationale: k8s deployment overlay is the target subsystem. Acceptable for discovered-scope bug.
  • [x] Forgejo issue -- pal-e-deployments#95, state: open

File Targets

  • [x] overlays/twitch-2k-wager/prod/harbor-creds.enc.yaml -- verified: file exists (2.0k bytes, SOPS-encrypted with age recipient age15ct78fr...). Line 5 contains encrypted namespace field. Encrypted blob length (~20 bytes) is consistent with "twitch-2k-wager" (15 chars). SOPS 3.12.1 installed on host, age key at ~/.config/sops/age/keys.txt confirmed present.
  • [x] SOPS workflow in issue body is correct and complete (decrypt to temp file, edit namespace, re-encrypt, remove plaintext).
  • [x] Supporting files verified: kustomization.yaml references harbor-creds.enc.yaml as a resource. deployment-patch.yaml and kustomization.yaml both use twitch-2k-wager naming consistently.

Repo Placement

Correct. Forgejo issue filed on pal-e-deployments, fix targets pal-e-deployments overlay. Single repo, no cross-repo concerns.

Dependencies

  • [x] No blockers on board-pal-e-platform. Item #828 is independent.
  • [x] pal-e-deployments#97 (pal-e-production harbor-creds namespace mismatch) -- same class of bug, correctly separated. No dependency between the two.
  • [x] forgejo_admin/twitch-2k-wager#63 (ADMIN_SECRET fix) -- referenced in lineage. No blocking dependency.

Acceptance Criteria

All 3 AC are verifiable by an agent:
  • [x] "harbor-creds Secret namespace updated to playme2k" -- agent runs sops --decrypt harbor-creds.enc.yaml | grep namespace
  • [x] "ArgoCD shows Synced for playme2k app" -- agent runs kubectl get application -n argocd playme2k -o jsonpath='{.status.sync.status}'. Note: requires post-merge ArgoCD sync cycle.
  • [x] "No regression in PlayMe2K deployment" -- agent verifies pods running via kubectl.
Test expectations (kustomize build, decrypt verification) are concrete and runnable.

Blast Radius

Checked all 11 overlay harbor-creds.enc.yaml files across pal-e-deployments. All have encrypted namespace fields -- cannot verify cleartext without decrypting each. The known secondary mismatch (pal-e-production) is already tracked as pal-e-deployments#97. This fix touches exactly 1 file in 1 overlay. Rollback is trivial (revert the SOPS re-encrypt). No downstream consumers affected beyond the playme2k ArgoCD app itself.

Decomposition Assessment

No decomposition needed.
  • 1 file target in 1 repo -- well under the 3-file limit
  • 3 acceptance criteria -- under the 5 AC limit
  • Estimated agent time: under 2 minutes (decrypt, sed, re-encrypt, commit)
  • No independent subtasks to parallelize

Recommendation

No action needed. Ticket is ready for agent dispatch.