Validation: ISS staging environment with auto-deploy
Verdict: PARTIAL
Ticket
svc#193 — Create ISS staging environment with auto-deploy on merge to main. Merged via PR #196. Tofu apply ran successfully via Woodpecker pipeline #275 (re-validation after prior FAIL).
Environment
k3s cluster (archbox), namespace
intelligentstaffingsystems-staging, ArgoCD app intelligentstaffingsystems-staging. Kustomize overlay at overlays/intelligentstaffingsystems/staging in pal-e-deployments.Checks
| # | Criterion | How Verified | Result | Evidence |
|---|---|---|---|---|
| 1 | Staging namespace exists | <code>kubectl get ns intelligentstaffingsystems-staging</code> | PASS | Status: Active, Age: ~9m |
| 2 | ArgoCD Application created and synced | <code>kubectl get application -n argocd</code> | PASS | Sync: Synced, Health: Healthy. Resources: Secret, Service, Deployment, ServiceMonitor all Synced. |
| 3 | Auto-sync enabled on ArgoCD app | ArgoCD app spec inspection | PASS | <code>syncPolicy.automated: {prune: true, selfHeal: true}</code> |
| 4 | Image Updater configured for auto-deploy | ArgoCD app annotation inspection | PASS | image-list: <code>harbor.tail5b443a.ts.net/intelligentstaffingsystems/app</code>, strategy: newest-build, allow-tags: <code>regexp:^[0-9a-f]{7,40}$</code>, write-back: git:repocreds to kustomization |
| 5 | Staging pod running with correct image | <code>kubectl get pods</code> + image jsonpath | PASS | 1/1 Running, 0 restarts. Image: <code>harbor.tail5b443a.ts.net/intelligentstaffingsystems/app:b46c433...</code> (matches latest main commit) |
| 6 | Staging service exists | <code>kubectl get svc</code> | PASS | ClusterIP 10.43.246.122, port 3000/TCP |
| 7 | App responds inside cluster | <code>kubectl exec ... curl localhost:3000</code> | PASS | HTTP 403 (expected — Keycloak auth enforcement, confirms Rails app is running) |
| 8 | Tofu apply succeeded | Woodpecker pipeline #275 | PASS | Pipeline status: success. Apply: "14 added, 5 changed, 4 destroyed." CI robot created. |
| 9 | Secrets deployed | <code>kubectl get secret</code> | PASS | <code>harbor-creds</code> (dockerconfigjson) + <code>intelligentstaffingsystems-staging-secrets</code> (Opaque, 10 keys) |
| 10 | External access (DNS + Caddy) | curl Tailscale funnel URL | BLOCKED | Tailscale funnel URL timed out. No DNS CNAME. Blocked by svc#198. |
| 11 | CNPG database provisioned | <code>kubectl get clusters.postgresql.cnpg.io</code> | BLOCKED | No CNPG resources found. Blocked by deploy#242. |
Regression Check
ISS production environment verified healthy: ArgoCD app
intelligentstaffingsystems Synced/Healthy, prod pod 1/1 Running with 0 restarts (age 20h). No regression from staging infrastructure changes.Discovered Issues
No new issues discovered. Three known blockers already tracked:
- svc#198 — DNS CNAME + Caddy vhost for staging
- svc#199 — Harbor staging robot cross-project pull access
- deploy#242 — CNPG database for staging
Note: harbor-creds secret exists and pod pulled successfully (from local cache). svc#199 concerns proper cross-project robot access for when images are not cached locally.