Validation: ISS dev ArgoCD service registration
Verdict: PASS
Ticket
svc#192 — Register ISS dev environment as terraform-managed ArgoCD service. Merged via PR #195. Board item #1892 on board-iss.
Environment
Production k3s cluster (archbox). Namespace:
iss-dev. ArgoCD app: iss-dev. Tailscale funnel: iss-dev.tail5b443a.ts.net. Tofu apply ran via Woodpecker pipeline #275 (manual trigger on main).Checks
| # | Criterion | How Verified | Result | Evidence |
|---|---|---|---|---|
| 1 | Tofu apply succeeded cleanly | Woodpecker pipeline #275 status | PASS | Pipeline #275: status=success, event=manual, branch=main. Steps: clone=success, apply=success, cross-pillar-review=success. |
| 2 | Tofu plan shows no iss-dev drift | <code>tofu plan -lock=false -var-file=k3s.tfvars</code> | PASS | Plan: 0 to add, 6 to change (all unrelated: ArgoCD instance label drift on mdview/iss-dev/gcal-scheduler, Keycloak sensitive value formatting), 0 to destroy. No iss-dev-specific drift. |
| 3 | ArgoCD application iss-dev exists and is synced | <code>kubectl get application iss-dev -n argocd</code> | PASS | Sync status: Synced. Operation phase: Succeeded. Source: overlays/intelligentstaffingsystems/dev from pal-e-deployments.git, targetRevision=main. |
| 4 | Namespace iss-dev exists | <code>kubectl get ns iss-dev</code> | PASS | Status: Active. |
| 5 | Kubernetes resources created and managed | ArgoCD resource list | PASS | All 5 resources Synced: Namespace (iss-dev), ConfigMap (nginx-config), Service (iss-dev, Healthy), Deployment (iss-dev, Degraded — see health note), Ingress (iss-dev, Healthy). |
| 6 | Tailscale funnel configured for dev access | <code>kubectl get ingress -n iss-dev</code> | PASS | ingressClassName=tailscale, tailscale.com/funnel=true. Load balancer hostname: iss-dev.tail5b443a.ts.net:443. |
| 7 | Auto-sync with prune and self-heal enabled | ArgoCD app spec inspection | PASS | syncPolicy.automated: prune=true, selfHeal=true. syncOptions: CreateNamespace=false. |
| 8 | Nginx reverse proxy correctly configured | <code>kubectl exec -- cat /etc/nginx/conf.d/default.conf</code> | PASS | Rendered config: proxy_pass http://100.110.151.59:8888; WebSocket upgrade headers; X-Forwarded-Proto https. Envsubst template correctly resolved UPSTREAM_TARGET. |
| 9 | No image updater annotations on dev ArgoCD app | ArgoCD app metadata inspection | PASS | Annotations: {} (empty). image_updater opt-out flag working as intended. |
| 10 | No Harbor resources created (image_updater=false) | <code>kubectl get secret harbor-creds -n iss-dev</code> | PASS | Error from server (NotFound): secrets "harbor-creds" not found — correctly skipped. |
Health Status Note
ArgoCD health shows Degraded because the Deployment readiness probe (HTTP GET /up on port 80) returns 404. This is expected and by-design: the iss-dev pod runs nginx:alpine as a reverse proxy to the developer's local machine (UPSTREAM=100.110.151.59:8888). The readiness probe passes only when the developer is actively running the Rails app locally with a healthy database. The infrastructure registration is complete and correct; the health will transition to Healthy when the dev app is running. The upstream IS reachable (returns HTTP responses with content), confirming the proxy is functional.
Regression Check
- pal-e-docs (image_updater=true): All 6 image updater annotations present, Harbor pull secret exists (69d old). No regression from image_updater flag introduction.
- ISS prod (intelligentstaffingsystems): Correctly has no image updater annotations (disabled by later PR #201). No regression.
- ISS staging (intelligentstaffingsystems-staging): Exists and operational. No regression.
- Tofu plan shows 0 resources to add or destroy — no unintended side effects.
Discovered Issues
None. All terraform-managed resources are created, synced, and functioning as designed. The /up 404 from the dev server is an operational state (dev server not fully initialized), not a registration defect.
Re-validation Context
Initial validation on 2026-07-26 failed because
k3s.tfvars had not been updated with the iss-dev entry and tofu apply had never been run — the ArgoCD app and namespace did not exist. The tfvars were updated and pipeline #275 (manual tofu apply on 2026-07-27) resolved this. Re-validation on 2026-07-27 confirms all resources are live and the previous FAIL root cause is fully resolved. Independent corroborating validation confirms tofu plan shows no iss-dev drift and all Kubernetes resources match expected state.