Validation: NetworkPolicy paldocs to Keycloak
Verdict: PASS
Ticket
ldraney/pal-e-platform#491 — Add paldocs namespace to Keycloak NetworkPolicy ingress allowlist. Merged via PR #493.
Board item #1708 on board-paldocs: [sprint:3] NetworkPolicy: paldocs→Keycloak
Environment
Production cluster (archbox), keycloak namespace. Keycloak service: ClusterIP 10.43.87.39:80/TCP. Paldocs pod: paldocs-8585d75c88-ch7p5 (10.42.0.196).
Checks
| # | Criterion | How Verified | Result | Evidence |
|---|---|---|---|---|
| 1 | paldocs namespace added to Keycloak NetworkPolicy ingress rules | kubectl get networkpolicy -n keycloak -o yaml | PASS | NetworkPolicy <code>default-deny-ingress</code> includes <code>namespaceSelector matchLabels kubernetes.io/metadata.name: paldocs</code>. Full allowlist: tailscale, westside-ai-assistant, pal-enterprises, landscaping-assistant, paldocs, monitoring, woodpecker, prediction-assistant, westside-basketball, intelligentstaffingsystems (10 namespaces). |
| 2 | tofu apply succeeds | Verified resource exists in cluster; subsequent pal-e-platform CI pipelines on main are green (pipelines #1505, #1504, #1501, #1499 all success) | PASS | NetworkPolicy resource is live with generation 15. Multiple successful CI pipelines have run on main since PR #493 merged, confirming no state drift. |
| 3 | paldocs pod can reach keycloak.keycloak.svc.cluster.local:80 | kubectl exec -n paldocs paldocs-8585d75c88-ch7p5 -- curl | PASS | Root URL (<code>/</code>) returns HTTP 302 (Keycloak redirect). OIDC discovery (<code>/realms/master/.well-known/openid-configuration</code>) returns HTTP 200. Connectivity fully confirmed. |
Regression Check
- Keycloak pod healthy: 1/1 Running, 0 restarts, 13 days uptime.
- landscaping-assistant can still reach keycloak (HTTP 302 on root) -- existing NetworkPolicy rules intact.
- All 10 namespaces present in NetworkPolicy allowlist -- no entries were dropped when paldocs was added.
- Paldocs pod healthy: 1/1 Running, 0 restarts.
Discovered Issues
The issue's test expectation stated
curl keycloak.keycloak.svc.cluster.local/health should return 200. In practice, Keycloak's health probe is on management port 9000 (/health/ready), not the HTTP port 80. On port 80, /health returns 404. The correct connectivity verification on port 80 is the root URL (302) or the OIDC discovery endpoint (200). This is a minor inaccuracy in the test expectation, not a functional defect. No follow-up issue required.