pal-e-docs

Review: Inject WESTSIDE_STREAMLIT_RO_PASSWORD via SOPS Secret

review-967-2026-04-10 Review

review approved
Project

Verdict: APPROVED

Emergency hot-fix. Scope is tight, file targets resolve, SOPS pattern is derivable, traceability complete. No blockers.

Template Completeness

  • [x] ### Type (Bug)
  • [x] Lineage
  • [x] Repo (pal-e-deployments)
  • [x] What Broke
  • [x] Repro Steps
  • [x] Expected Behavior
  • [x] Environment
  • [x] File Targets (create + modify + do-not-touch lists)
  • [x] Acceptance Criteria (11 measurable items)
  • [x] Test Expectations
  • [x] Constraints
  • [x] Related

Traceability

  • [x] story:WS-S31 label — "long-standing public jersey order link" story verified on project-westside-basketball user-stories section (Admin → Marcus)
  • [x] arch:jersey-intake label — component reference present (foundational infra fix)
  • [x] Forgejo issue forgejo_admin/basketball-api#449 — OPEN, title matches board item
  • [x] Lineage trail: #441, #443, PR #444, PR #5/#435

File Targets

  • [x] pal-e-deployments/overlays/basketball-api/prod/ — verified (contains deployment-patch.yaml, harbor-creds.enc.yaml, kustomization.yaml, postgres.yaml, pvc.yaml)
  • [x] harbor-creds.enc.yaml — verified, contains SOPS age recipient block (age15ct78fr4scv4vxzj3k6q76wshywzlu0mdc64a624e264dst7zfaq6tjzjr). Agent can derive the SOPS recipient pattern as the ticket instructs.
  • [x] kustomization.yaml — verified, resources: list includes harbor-creds.enc.yaml (line to append next to)
  • [x] deployment-patch.yaml — verified, app container has env: list at line 30 with existing valueFrom entries (appendable)
  • [x] westside-streamlit-secret.enc.yaml — confirmed NOT present (will be created)
  • [x] ~/secrets/pal-e-services/westside-streamlit.env — verified exists on host
  • [x] grep WESTSIDE_STREAMLIT on deployment-patch.yaml — zero matches, env var does not already exist

Repo Placement

OK. Fix lives in pal-e-deployments overlay (deploy environment), not basketball-api (migration code is correct). Ticket is explicit that basketball-api repo must not be touched. Forgejo issue is filed on basketball-api#449 for lineage visibility with sister bugs #441/#443, which is acceptable — the body clearly points to pal-e-deployments as the actual fix repo.

Dependencies

Unblocks: rollout of image post-#444 merge (migration 044 can finally run). No blocking dependencies — PR #444 already merged, alembic chain is ready. Old pod still serving (no outage), so this is urgency without emergency panic.

Acceptance Criteria

11 criteria, all measurable: file existence, SOPS decrypt, kustomize build + dry-run apply, post-rollout kubectl env inspection, pg_roles query, alembic_version check, ArgoCD Synced/Healthy, no plaintext password in git. Every criterion is verifiable by a fresh-context agent after merge.

Blast Radius

Contained. Only basketball-api/prod overlay modified. New Secret is scoped to basketball-api namespace and only read by basketball-api deployment. No sibling service uses the streamlit RO role. Constraint section explicitly forbids modifying basketball-api-secrets (externally managed), which is the one real foot-gun here.

Decomposition Assessment

No decomposition needed. File count: 1 new + 2 modified = 3 files, all within one overlay directory. AC count: 11 but every criterion is a simple kubectl/sops/kustomize check — no fan-out. Estimated agent time: under 5 minutes (encrypt one secret, add one line to kustomization.yaml, append one env block to deployment-patch.yaml). Single-repo, single-directory, hot-fix profile. Fits comfortably in a single agent pass — no route to skill-decompose-ticket.

Recommendation

No action needed. Ticket is ready for dev dispatch. Advance backlog → todo → next_up.
Minor observations (non-blocking, not requiring refinement):
  • The "Related" section notes a follow-up process gap (PR template should require kustomize env-var updates when a migration reads an env var). That belongs as a separate backlog ticket on the platform board post-fix — do not expand this ticket's scope.
  • Ticket says "advance to 044 (and 043 jersey_public_orders if the chain order resolves that way)" — chain order is an existing known concern, not introduced by this fix. Leave as-is.