From ac2b818598f9530af25847cc243920b96a90c6b6 Mon Sep 17 00:00:00 2001 From: Agustin Celentano <12614595+agustincelentano@users.noreply.github.com> Date: Mon, 7 Sep 2026 11:25:02 -0300 Subject: [PATCH] fix(scheduled-task): run the image as the k8s scope with the overlay and ship aws-cli The image baked NP_SERVICE_PATH=/app/pkg/scheduled_task with no NP_OVERRIDES_PATH, so the worker ran the overlay's partial workflows (two skipped steps) as the whole scope. Point the base at k8s and pass the overlay as NP_OVERRIDES_PATH, like the legacy channel and containers-datadog do. Add aws-cli: the k8s scripts call it from the assume_role step onwards. --- docker/scheduled-task.Dockerfile | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/docker/scheduled-task.Dockerfile b/docker/scheduled-task.Dockerfile index 1ece0e96..f4f994be 100644 --- a/docker/scheduled-task.Dockerfile +++ b/docker/scheduled-task.Dockerfile @@ -4,7 +4,10 @@ # its steps only reach for kubectl + gomplate (bash/jq/np ship in the base). FROM public.ecr.aws/nullplatform/scopes/worker-bridge:1.0.0 -RUN apk add --no-cache gomplate +# aws-cli: the k8s scope scripts this overlay runs on top of call `aws` (sts +# assume-role first of all, then IAM and ECR); without it every action fails at +# the assume_role step on AWS installs. +RUN apk add --no-cache aws-cli gomplate ARG TARGETARCH ARG KUBECTL_VERSION=1.30.4 @@ -13,6 +16,11 @@ RUN curl -fsSL -o /usr/local/bin/kubectl "https://dl.k8s.io/release/v${KUBECTL_V && kubectl version --client COPY . /app/pkg +# The scheduled task is the k8s scope run with the scheduled_task overlay (see +# scheduled_task/specs/notification-channel.json.tpl: --service-path=k8s +# --overrides-path=scheduled_task), so the base stays k8s and the overlay goes +# in NP_OVERRIDES_PATH, like containers-datadog does. ENV NP_PACKAGE_NAME=scheduled-task \ - NP_SERVICE_PATH=/app/pkg/scheduled_task \ + NP_SERVICE_PATH=/app/pkg/k8s \ + NP_OVERRIDES_PATH=/app/pkg/scheduled_task \ NP_SCOPE_ENTRYPOINT=/app/pkg/entrypoint