Service Onboarding Port + Registry Validation

todo-service-onboarding-validation Doc

todo done

Project

Goal: Add pre-deploy validation checks to the service onboarding SOP and CI so port/registry mismatches are caught before deploy, not after.

Owner: Betty Sue (SOP update) + Dev agent (CI validation)

Repo: pal-e-platform, pal-e-deployments

Depends on: None

Discovered during mcd-tracker-app deployment (2026-03-16). Three bugs hit in sequence:

Harbor project name mismatch: Pipeline pushed to mcd-tracker/app but robot account was scoped to mcd-tracker-app project. Fix: service onboarding SOP must verify image_repo matches the Harbor project terraform creates.
Port mismatch: Dockerfile serves on port 80, kustomize overlay + service + probes all said 3000. Fix: add a validation step that checks Dockerfile EXPOSE matches kustomize containerPort, service port, and probe port.
Ingress port stale after terraform update: Targeted tofu apply didn't recreate the ingress. Fix: document that port changes require ingress recreation or full apply.
Woodpecker repo activation not in MCP: Had to call API directly. Fix: add activate_repo to woodpecker-sdk.