pal-e-docs

Validation: basketball-api#449 — WESTSIDE_STREAMLIT_RO_PASSWORD env var injection

validation-449-2026-04-11 Doc

validation pass
Project

Validation: basketball-api#449 — WESTSIDE_STREAMLIT_RO_PASSWORD env var injection

Verdict: PASS — 2026-04-11 20:37 UTC, after pal-e-deployments PR #111 merged and ArgoCD reconciled.

Acceptance criteria verified

Check Command Result
Secret exists in cluster <code>kubectl -n basketball-api get secret westside-streamlit-secret</code> ✅ Opaque, 1 data key, 33s old
Env var injected on deployment <code>kubectl -n basketball-api get deploy basketball-api -o jsonpath='{.spec.template.spec.containers[0].env[*].name}'</code> ✅ includes <code>WESTSIDE_STREAMLIT_RO_PASSWORD</code>
basketball-api pod healthy <code>kubectl -n basketball-api get pods -l app=basketball-api</code> ✅ 1/1 Running, 0 restarts, 47s old
Old CrashLoop pod terminated — ✅ <code>basketball-api-5c4b9bcc-vvfsx</code> (20h) terminated cleanly
ArgoCD app state <code>kubectl -n argocd get application basketball-api</code> ✅ <code>Synced / Healthy</code> (was <code>Degraded</code> for 20+ hours)
alembic_version reaches 044 <code>psql -tc "SELECT version_num FROM alembic_version"</code> ✅ <code>044</code> (was <code>042</code>)
<code>westside_streamlit_ro</code> postgres role exists <code>psql -tc "SELECT 1 FROM pg_roles WHERE rolname='westside_streamlit_ro'"</code> ✅ returns <code>1</code>
<code>jersey_public_orders</code> table exists (collateral, from 043) <code>psql -c "\dt jersey_public_orders"</code> ✅ table present, owner=basketball
No plaintext password in git <code>git log -p</code> on PR #111 ✅ SOPS-encrypted, recipient matches harbor-creds.enc.yaml

Fix chain

  • basketball-api#433 — original T2 jersey_public_orders migration (introduced 040 collision)
  • basketball-api#442 — fixed 040 collision (renamed jersey migration to 043)
  • basketball-api#444 — fixed 041 collision (renamed streamlit_ro to 044) — UNCOVERED the env var bug
  • pal-e-deployments#111 — injected the env var via new SOPS-encrypted Secret westside-streamlit-secret + envFrom in deployment-patch.yaml

What this unblocks

  • basketball-api deploy pipeline (was stuck for 20+ hours)
  • System B production rollout (jersey_public_orders table now exists for the POST/GET endpoints)
  • Future migrations can land cleanly
  • westside-streamlit dashboard can finally use its read-only role
  • Woodpecker should run alembic heads as a pre-build check to fail-fast on dual-revision collisions
  • PR template should require: "if your migration reads an env var, the same PR must update the basketball-api kustomize overlay to inject it"
  • basketball-api CI test step has been failing for 5+ merges (test drift in test_templated_email and test_first_payment_email) — not gated, deploys go through anyway per commit f17b49b
  • arch-jersey-intake — System B architecture
  • story:WS-S31
  • basketball-api#441, basketball-api#443, basketball-api#449, pal-e-deployments#110 — all closed by this fix chain