Apply pal-e-platform TF drift — 11 resources #372

New issue

Open

opened 2026-05-19 02:18:23 +00:00 by ldraney · 0 comments

ldraney commented

2026-05-19 02:18:23 +00:00

Owner

Type

Bug

Lineage

Standalone — discovered during platform drift audit 2026-05-18.

Repo

ldraney/pal-e-platform

What Broke

tofu plan shows 11 drifted resources (5 add, 5 change, 1 destroy). Code and cluster are out of sync.

Create (5): admin_app_user_provision job, admin_app_db_url_westside_admin secret (re-create), paledocs_db_url secret, embedding_worker_metrics service.

Update (5): netpol_postgres NetworkPolicy, woodpecker Helm release, harbor_portal_nginx ConfigMap, harbor_portal_proxy Deployment, minio Helm release (v5.4.0).

Replace (1): harbor_oidc null_resource (tainted, re-runs provisioner).

Repro Steps

cd ~/pal-e-platform/terraform && tofu plan — observe 11 changes
Note the tainted harbor_oidc and Helm value drift on Woodpecker/MinIO

Expected Behavior

tofu plan should show "No changes" when code matches cluster state.

Environment

Cluster/namespace: prod / multiple namespaces
TF state: ~/pal-e-platform/terraform

Acceptance Criteria

Each change reviewed for safety (especially tainted harbor_oidc provisioner)
westside_admin DB URL re-create confirmed harmless (project decommissioning)
tofu apply succeeds
tofu plan shows "No changes" after apply
Harbor, Woodpecker, MinIO remain healthy post-apply

project-pal-e-platform — platform operations

### Type Bug ### Lineage Standalone — discovered during platform drift audit 2026-05-18. ### Repo `ldraney/pal-e-platform` ### What Broke `tofu plan` shows 11 drifted resources (5 add, 5 change, 1 destroy). Code and cluster are out of sync. **Create (5):** `admin_app_user_provision` job, `admin_app_db_url_westside_admin` secret (re-create), `paledocs_db_url` secret, `embedding_worker_metrics` service. **Update (5):** `netpol_postgres` NetworkPolicy, `woodpecker` Helm release, `harbor_portal_nginx` ConfigMap, `harbor_portal_proxy` Deployment, `minio` Helm release (v5.4.0). **Replace (1):** `harbor_oidc` null_resource (tainted, re-runs provisioner). ### Repro Steps 1. `cd ~/pal-e-platform/terraform && tofu plan` — observe 11 changes 2. Note the tainted `harbor_oidc` and Helm value drift on Woodpecker/MinIO ### Expected Behavior `tofu plan` should show "No changes" when code matches cluster state. ### Environment - Cluster/namespace: prod / multiple namespaces - TF state: ~/pal-e-platform/terraform ### Acceptance Criteria - [ ] Each change reviewed for safety (especially tainted harbor_oidc provisioner) - [ ] westside_admin DB URL re-create confirmed harmless (project decommissioning) - [ ] `tofu apply` succeeds - [ ] `tofu plan` shows "No changes" after apply - [ ] Harbor, Woodpecker, MinIO remain healthy post-apply ### Related - `project-pal-e-platform` — platform operations