Validation: Fix image-updater write-back to argocd, reconcile state
Verdict: PASS
Ticket
ldraney/pal-e-services#81 — Fix image-updater: switch write-back to argocd, reconcile state for all services. Merged via PR #82.
Environment
Production k3s cluster (archbox), argocd namespace, believers-elite namespace. Validated via kubectl and tofu plan against live state.
Checks
| # | Criterion | How Verified | Result | Evidence |
|---|---|---|---|---|
| 1 | services.tf uses <code>argocd</code> write-back method (not <code>git:secret:argocd/git-creds</code>) | Read services.tf line 135; checked live ArgoCD Application annotation via kubectl | PASS | <code>"argocd-image-updater.argoproj.io/write-back-method": "argocd"</code> in both terraform source and live annotation |
| 2 | Terraform state matches live ArgoCD Applications for all services (<code>tofu state rm</code> + <code>tofu import</code>) | <code>tofu plan -var-file=k3s.tfvars -lock=false</code> | PASS | Plan shows 0 to add, 2 to change (cosmetic label drift on harbor-creds secrets for gcal-scheduler and westsidekingsandqueens — ArgoCD added <code>argocd.argoproj.io/instance</code> labels, unrelated to this fix), 0 to destroy. All 7 ArgoCD applications refreshed clean. |
| 3 | <code>tofu plan</code> is clean after apply | Same plan output as AC #2 | PASS | No ArgoCD application or image-updater drift. The 2 label changes are pre-existing cosmetic drift on harbor-creds secrets, not introduced by this change. |
| 4 | Image Updater logs show <code>applications=4</code> and believers-elite appears in processing | <code>kubectl logs -n argocd -l app.kubernetes.io/name=argocd-image-updater</code> | PASS | Logs show <code>applications=7</code> (platform has grown from 4 to 7 services since AC was written). believers-elite confirmed in processing: <code>"Processing application argocd/believers-elite"</code>, <code>"Considering this image for update"</code>. <code>errors=0</code>. |
| 5 | Push a test commit and confirm image auto-updates without manual intervention | Verified commit <code>c876865</code> (favicon commit) triggered Woodpecker pipeline #2 (success), image pushed to Harbor, Image Updater detected and set live deployment to tag <code>c876865678d1...</code>. Commit <code>4bb8e1f</code> triggered pipeline #3 (currently running). | PASS | Live deployment: <code>harbor.tail5b443a.ts.net/believers-elite/app:c876865678d1becb00168d15f0600a2429c18f96</code>. Image Updater log: <code>"Image already on latest allowed version"</code> confirming it tracked and matched. End-to-end flow: commit → Woodpecker CI → Harbor push → Image Updater detection → ArgoCD deployment. Fully automated, no manual intervention. |
Regression Check
All ArgoCD applications verified:
- believers-elite: Synced, Healthy
- gcal-scheduler: Synced, Healthy
- notion-mcp-remote: Synced, Healthy
- pal-e-docs: Synced, Healthy
- westsidekingsandqueens: Synced, Healthy
- basketball-api: OutOfSync, Degraded (ImagePullBackOff — pre-existing, unrelated)
- pal-enterprises: Synced, Degraded (CreateContainerConfigError — pre-existing, unrelated)
- westside-email: Unknown sync, Healthy (no image-updater annotation — expected)
The two degraded apps (basketball-api, pal-enterprises) are pre-existing issues unrelated to this fix. The image-updater write-back change did not introduce any regressions.
Discovered Issues
- Cosmetic label drift: ArgoCD adds
argocd.argoproj.io/instancelabels to harbor-creds secrets in gcal-scheduler and westsidekingsandqueens namespaces.tofu planwants to remove them. Low priority — does not affect functionality. Could be addressed withlifecycle { ignore_changes }on the label block. - basketball-api ImagePullBackOff: Pre-existing, not caused by this change. Already visible before merge.
- pal-enterprises CreateContainerConfigError: Pre-existing (11 days old), not caused by this change.