Validation: Remove :80 from ArgoCD repo URLs (pal-e-services#36)

validation-36-2026-03-27 Validation

validation partial

Project

Verdict: PARTIAL

Ticket

forgejo_admin/pal-e-services#36 — Remove explicit :80 from ArgoCD repo_url and repository_credentials to match credential resolution and manifest cache keys.

Environment

Prod cluster, argocd namespace. Validated from archbox against forgejo/main at commit dc771c7 (pal-e-services).

Checks

#	Criterion	How Verified	Result	Evidence
1	repo_url uses no-port URL in services.tf	<code>git show forgejo/main:terraform/services.tf \| grep forgejo</code>	PASS	Line 148: <code>http://forgejo-http.forgejo.svc.cluster.local/${...}.git</code> — no :80
2	argocd_repository_credentials URL uses no-port in main.tf	<code>git show forgejo/main:terraform/main.tf \| grep forgejo</code>	PASS	Line 320: <code>url = "http://forgejo-http.forgejo.svc.cluster.local"</code> — no :80
3	tofu plan shows no port-related drift (code matches live state)	<code>tofu plan -lock=false -var-file=k3s.tfvars</code> from forgejo/main checkout	FAIL	tofu apply has NOT been run. Plan shows:<br/> - <code>argocd_repository_credentials.forgejo</code> must be REPLACED: <code>:80</code> → no-port (forces replacement)<br/> - <code>basketball-api</code> app still has <code>:80</code> in live repo_url → plan wants to remove it<br/> - All other apps show drift for repo migration (gcal-scheduler, pal-e-app, pal-e-docs, platform-validation, westsidekingsandqueens moving to pal-e-deployments)<br/> - Plan: 4 to add, 11 to change, 2 to destroy
4	ArgoCD apps not stuck on credential mismatch	<code>kubectl get applications -n argocd</code>	PASS	8 of 9 apps are Healthy. basketball-api is OutOfSync (still has :80 URL) but Healthy. westsidekingsandqueens is OutOfSync+Healthy (separate issue — repo migration). pal-e-app is Synced but Degraded (unrelated). No apps are stuck in Unknown or Error state from credential mismatch.

Regression Check

No regressions from the code change itself. The code on forgejo/main is correct — :80 removed from both files. The issue is that tofu apply has not been run yet, so the live ArgoCD state still has the old :80 URLs in some places. Specifically, argocd_repository_credentials.forgejo still has id http://forgejo-http.forgejo.svc.cluster.local:80 and basketball-api still references the :80 URL. The other apps were previously band-aided via kubectl and use no-port URLs, which is why they work.

Discovered Issues

tofu apply required — The PR is merged but the fix is NOT live. A tofu apply -var-file=k3s.tfvars is needed to actually push the :80 removal to ArgoCD. The plan shows the credential resource will be force-replaced (destroy + create) which needs careful execution. This is part of the broader pal-e-deployments migration apply (parent: pal-e-platform#201).
basketball-api still has :80 — The only ArgoCD app with a live :80 repo_url. It is OutOfSync but Healthy (cached manifests still work). The tofu apply will fix this.