pal-e-docs

Validation: Fix Image Updater write-back: stale kustomize.images override blocks deploys

validation-101-2026-05-24 Doc

validation pass
Project

Verdict: PASS

Ticket

ldraney/pal-e-services#101 — Removed stale lifecycle { ignore_changes } block from ArgoCD application terraform resource and cleared stale kustomize.images overrides from 3 apps so Image Updater git write-back deploys propagate correctly.
Merged PR: ldraney/pal-e-services#102 (commit 44490d0)
Board item: #1247 on board-production-pipeline

Environment

Prod cluster (k3s on archbox), ArgoCD namespace, all service namespaces. Tailscale funnel URL: https://landscaping-assistant.tail5b443a.ts.net

Tiers Executed

Tier 1 (local: tofu plan), Tier 3 (prod: kubectl + curl). Tier 2 skipped (no staging environment).

Checks

# Criterion How Verified Result Evidence
1 Annotations and lifecycle block agree on one write-back strategy Pulled main (commit <code>44490d0</code>), inspected <code>services.tf</code>. <code>lifecycle { ignore_changes }</code> block removed entirely. Only <code>git:repocreds</code> annotation remains at line 135. PASS <code>grep -n 'lifecycle\|ignore_changes' services.tf</code> returns no matches in the ArgoCD application resource.
2 Stale kustomize.images overrides cleared from all ArgoCD apps <code>kubectl get application -n argocd {app} -o jsonpath='{.spec.source.kustomize}'</code> for landscaping-assistant, notion-mcp-remote, pal-e-docs PASS All 3 apps return empty string (no kustomize override present).
3 Push a test commit, confirm new image deploys without manual intervention <code>kubectl get deployment landscaping-assistant -n landscaping-assistant -o jsonpath='{.spec.template.spec.containers[0].image}'</code> PASS Image tag: <code>harbor.tail5b443a.ts.net/landscaping-assistant/app:86a6ba036e9113b61d28c0519ac331b4ba04d619</code> — matches expected tag from the test commit. Pod running, 0 restarts.
4 Comment in terraform matches actual behavior Read <code>services.tf</code> lines 165-176 after merge. Stale comment "Image Updater uses argocd write-back" removed along with lifecycle block. PASS No misleading comments remain. Resource goes directly from <code>sync_options</code> to <code>depends_on</code>.

Regression Check

  • tofu plan -var-file=k3s.tfvars -lock=false: 0 ArgoCD application changes. Only 2 unrelated harbor-creds label drifts (gcal-scheduler, westsidekingsandqueens — ArgoCD instance label, pre-existing).
  • All 10 ArgoCD apps: Synced. 9/10 Healthy. pal-enterprises Degraded (pre-existing, unrelated).
  • curl -s -o /dev/null -w "%{http_code}" https://landscaping-assistant.tail5b443a.ts.net returns 200.
  • landscaping-assistant pod: 1/1 Running, 0 restarts, age 4h.

Discovered Issues

None. All checks pass cleanly. The pre-existing pal-enterprises Degraded status and harbor-creds label drift are known and unrelated to this ticket.