Validation: Service onboarding (issue #1)
Verdict: PARTIAL
Ticket
forgejo_admin/twitch-2k-wager#1 — Service onboarding: Keycloak + Twitch IdP + CNPG + funnel
Board item #786 on board-twitch-2k-wager
Environment
Production cluster (archbox), namespace: playme2k, Tailscale funnel: playme2k.tail5b443a.ts.net
Checks
| # | Criterion | How Verified | Result | Evidence |
|---|---|---|---|---|
| 1 | Namespace playme2k exists | kubectl get ns playme2k | PASS | NAME playme2k STATUS Active AGE 13h |
| 2 | Keycloak realm twitch-2k-wager exists | Keycloak admin API GET /admin/realms/twitch-2k-wager | PASS | Realm: twitch-2k-wager, Enabled: True, DisplayName: Twitch 2K Wager |
| 3 | Harbor project playme2k exists | Harbor API GET /api/v2.0/projects?name=playme2k (authenticated) | FAIL | Empty array returned. No playme2k project in Harbor. CI pushed via internal URL harbor.harbor.svc.cluster.local but project not created via Harbor API. |
| 4 | ArgoCD app exists | kubectl get application -n argocd playme2k | PASS | Application exists, pointing to overlays/twitch-2k-wager/prod. Status: OutOfSync/Progressing (expected given Harbor issue). |
| 5 | Tailscale funnel resolves | curl -sk https://playme2k.tail5b443a.ts.net | FAIL | HTTP 000 (connection refused). Prod pod in ImagePullBackOff, so funnel has no healthy backend. |
| 6 | CNPG database cluster exists | kubectl get clusters.postgresql.cnpg.io -n playme2k | FAIL | No CNPG resources found in playme2k namespace. |
| 7 | harbor-creds secret in namespace | kubectl get secret -n playme2k harbor-creds | FAIL | Error from server (NotFound): secrets "harbor-creds" not found. FailedToRetrieveImagePullSecret events on pod. |
Regression Check
No regression — this is a new namespace/service. Existing services unaffected.
Discovered Issues
- Harbor project playme2k does not exist — CI pushed via internal URL but the project was never created through Harbor API/terraform. Pods cannot pull the image externally.
- harbor-creds imagePullSecret missing in playme2k namespace — needs to be provisioned by terraform or sealed secret.
- CNPG database cluster not provisioned — ticket title mentions CNPG but no PostgreSQL cluster resource exists.
- Prod funnel not serving traffic due to cascading Harbor/image failures.