Validation: Create ISS staging environment with auto-deploy on merge to main
Verdict: PASS
Ticket
ldraney/pal-e-services#193 — Create ISS staging environment with auto-deploy on merge to main. Adds a terraform-managed staging service that auto-deploys the ISS Rails app on every merge to main via ArgoCD Image Updater.
Environment
Production k3s cluster (archbox). Namespace:
intelligentstaffingsystems-staging. ArgoCD app: intelligentstaffingsystems-staging. Tailscale funnel: intelligentstaffingsystems-staging.tail5b443a.ts.net.Checks
| # | Criterion | How Verified | Result | Evidence |
|---|---|---|---|---|
| 1 | Terraform state clean (no drift for staging resources) | <code>tofu plan -lock=false -var-file=k3s.tfvars</code> | PASS | All 7 staging resources refreshed with no planned changes: namespace, harbor_project, 2x robot_accounts, harbor_creds, ingress, argocd_application |
| 2 | ArgoCD application synced and healthy | <code>kubectl get application -n argocd intelligentstaffingsystems-staging</code> | PASS | Sync: Synced, Health: Healthy. Resources: Secret (Synced), Service (Synced/Healthy), Deployment (Synced/Healthy), ServiceMonitor (Synced) |
| 3 | Staging pod running with correct image | <code>kubectl get pods -n intelligentstaffingsystems-staging -o wide</code> | PASS | Pod <code>intelligentstaffingsystems-staging-568fd4699b-cll5z</code> Running 1/1, 0 restarts. Image: <code>harbor.tail5b443a.ts.net/intelligentstaffingsystems/app:b46c43399b...</code> matches ISS main HEAD (b46c433) |
| 4 | Image Updater auto-deploy configured | <code>kubectl get application -n argocd intelligentstaffingsystems-staging -o json</code> (annotations) | PASS | Annotations present: image-list points to <code>harbor.../intelligentstaffingsystems/app</code>, strategy=newest-build, allow-tags=commit-hash regex, write-back=git:repocreds to kustomization on main |
| 5 | Staging databases created | <code>kubectl exec -n postgres pal-e-postgres-1 -- psql -c "SELECT datname..."</code> | PASS | 4 databases exist: intelligentstaffingsystems_staging, _staging_cache, _staging_queue, _staging_cable |
| 6 | Tailscale funnel ingress active | <code>kubectl get ingress -n intelligentstaffingsystems-staging</code> + <code>curl -sk</code> | PASS | Ingress <code>intelligentstaffingsystems-staging-funnel</code> exists (class: tailscale, ports 80/443). curl returns HTTP 403 (consistent with prod behavior behind auth) |
| 7 | Woodpecker pipeline green for merge | <code>mcp__woodpecker__get_pipeline_status(#260)</code> | PASS | Pipeline #260 (pull_request_closed, "feat: create ISS staging environment...") status: success |
Regression Check
Production ISS app (
intelligentstaffingsystems) verified: Synced, Healthy, pod Running with 0 restarts (20h uptime). Tofu plan shows 6 unrelated changes (keycloak realm drift on iss/westside, mdview ingress label, iss-dev namespace label, gcal-scheduler harbor-creds label) — none affect staging resources.Discovered Issues
None. The staging environment is fully operational and auto-deploying correctly from the ISS main branch.