pal-e-docs

Review: fix basketball-api network policy missing self + westside-contracts ingress

review-843-2026-04-03 Review

review ready
Project

Verdict: READY

Template Completeness

  • [x] Type — Bug
  • [x] Lineage — Standalone, discovered during contract email send session (2026-04-05)
  • [x] Repo — forgejo_admin/pal-e-platform
  • [x] What Broke — clear description of ECONNREFUSED from missing ingress rules
  • [x] Repro Steps — present, actionable
  • [x] Expected Behavior — present
  • [x] Environment — namespace, timestamp, and manual patch noted
  • [x] Acceptance Criteria — 4 criteria, all testable
  • [x] Related — references correct repo, project, and SOP

Traceability

  • [ ] story:PLAT-S1 label — UNKNOWN KEY. The project-pal-e-platform user stories table uses keys like story:superuser-deploy, story:superuser-observe, etc. There is no PLAT-S1 entry. This likely maps to story:superuser-deploy (infrastructure changes via tofu apply succeed without breaking services). Acceptable as foundational work — the label is non-standard but the intent is clear.
  • [ ] story note — No PLAT-S1 entry exists in the user-stories section. If the label is meant to reference superuser-deploy, that story does exist.
  • [x] arch:network-security label — network-security component
  • [x] arch note verified — sop-network-security exists in pal-e-docs (active SOP with full three-layer architecture, key files table, and operational lessons). No dedicated arch-network-security note exists, but the SOP serves as the authoritative architecture reference for this component.
  • [x] Forgejo issue — #270, open

File Targets

  • [x] terraform/network-policies.tf — verified: file exists (249 lines on disk). The committed version at HEAD contains a netpol_basketball_api resource (lines 203-223) that only allows tailscale and monitoring. Working tree has this resource DELETED (unstaged change from manual debugging). The fix needs to restore and expand this resource with the correct ingress rules.

Repo Placement

Correct. The sop-network-security SOP says service namespaces should use pal-e-deployments/bases/standard/networkpolicy.yaml, but the basketball-api kustomization has its NetworkPolicy patch commented out (lines 54-72 in pal-e-deployments/overlays/basketball-api/prod/kustomization.yaml) due to a kube-router ipset bug (Forgejo #24). The Terraform approach in pal-e-platform is the current working pattern — the resource already exists at HEAD. Fixing it in place is correct.
Note: the namespace is hardcoded as "basketball-api" (string literal) rather than a module output reference, because basketball-api is a service namespace not managed by a pal-e-platform terraform module. This is consistent with how the resource was originally added.

Dependencies

  • [x] Board item #521 (todo): "Apply 5+ pending terraform changes" — related but not blocking. The netpol fix is a standalone TF file change; actual cluster effect requires tofu apply which can happen via #521 or independently.
  • [x] Working tree state — the current working tree has the resource DELETED (unstaged change). The implementing agent must work from a clean branch off HEAD, not from the dirty working tree.
  • [x] Manual kubectl patch — live in cluster, will be overwritten on next tofu apply. No dependency, but confirms the fix is urgent.

Acceptance Criteria

All 4 criteria are testable by an agent:
  • AC1: netpol_basketball_api resource exists in network-policies.tf — grep verification
  • AC2: Policy allows self-namespace, tailscale, monitoring, westside-contracts, westside-ai-assistant — code inspection of ingress rules
  • AC3: tofu plan -lock=false shows no breakage — verifiable via plan output (actual apply deferred)
  • AC4: westside-contracts can query basketball-api postgres after apply — verifiable via plan output showing correct ingress rules; live verification deferred to apply
All criteria are specific and programmatically verifiable. No ambiguity.

Blast Radius

  • No similar bug in other netpols. All other platform namespace policies in the committed file include self-namespace ingress. basketball-api was the only one missing it.
  • Downstream consumers confirmed: westside-contracts connects to postgres.basketball-api.svc.cluster.local:5432 (verified in westside-contracts/kustomize/overlays/prod/secrets.yaml:8). The fix correctly adds this ingress.
  • Rollback: straightforward — kubectl delete networkpolicy default-deny-ingress -n basketball-api or revert the PR.
  • Minor observation: The minio netpol still references pal-e-mail namespace (line 126), which is a dead project. Not in scope for this ticket.

Decomposition Assessment

No decomposition needed.
  • File targets: 1 file (terraform/network-policies.tf)
  • Repos: 1 (pal-e-platform)
  • Acceptance criteria: 4 (under the 5 threshold)
  • Estimated agent time: <5 minutes — straightforward resource modification following established patterns in the same file
  • No independent subtasks to parallelize — this is a single atomic change

Recommendation

  • [LABEL] Change story:PLAT-S1 to story:superuser-deploy on board item #843 to match the project page user-stories table convention. If PLAT-S1 is intentionally a new key, the user-stories table on project-pal-e-platform needs an entry for it.