Beta to main

CHANGELOG.md

@@ -5,6 +5,10 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.16.3] - 2026-09-08
+- Add: remove resource level restriction for `elasticloadbalancing:Describe*` permissions as AWS does not support it.
+- Fix: k8s deployment logs no longer show a "np_trace_flush: command not found" error when tracing is disabled
+
 ## [1.16.2] - 2026-09-08
 - Fix: the scheduled-task worker image now runs the k8s scope with the scheduled_task overlay (`NP_OVERRIDES_PATH`), like the legacy channel does — it previously executed the overlay's partial workflows as the whole scope — and ships aws-cli, which the k8s scripts need from the assume_role step onwards
 - The publish pipeline now registers every scope image artifact with its release tag, so packages can resolve a worker image by tag (`lookup = true` + `meta.tag`) instead of copying digests around

k8s/deployment/tests/wait_deployment_active.bats

@@ -992,3 +992,22 @@ JSON
   [ "${#capped}" -eq 140 ]
   case "$capped" in *"...") ;; *) return 1 ;; esac
 }
+
+# =============================================================================
+# Tracing SDK Absent
+# =============================================================================
+@test "wait_deployment_active: reports readiness without np_trace_flush when the tracing SDK is not loaded" {
+  np_scope_progress() { :; }
+  np_scope_consumes() { :; }
+  np_scope_produces() { :; }
+  np_scope_affordance() { :; }
+  export -f np_scope_progress np_scope_consumes np_scope_produces np_scope_affordance
+
+  export CONTEXT='{"asset":{"url":"registry.example.com/app:1.0.0","type":"docker-image"},"application":{"id":"app-789"},"scope":{"id":"scope-123"},"deployment":{"created_at":"2026-09-08T10:00:00Z"}}'
+
+  run bash "$BATS_TEST_DIRNAME/../wait_deployment_active"
+
+  [ "$status" -eq 0 ]
+  assert_contains "$output" "✅ All pods in deployment 'd-scope-123-deploy-456' are available and ready!"
+  [[ "$output" != *"np_trace_flush: command not found"* ]]
+}

k8s/deployment/wait_deployment_active

@@ -369,7 +369,9 @@ while true; do
                 np_scope_affordance "{\"kind\":\"deploy-log\",\"application_id\":\"$_wda_app_id\",\"scope_id\":\"$_wda_scope_id\",\"type\":\"application\"${_wda_start_ms:+,\"start_time\":$_wda_start_ms}}"
             fi
 
-            NP_TRACE_FLUSH_TIMEOUT=10 np_trace_flush
+            if command -v np_trace_flush >/dev/null 2>&1; then
+                NP_TRACE_FLUSH_TIMEOUT=10 np_trace_flush
+            fi
         fi
         break
     fi

k8s/specs/requirements/aws/main.tf

@@ -103,7 +103,10 @@ resource "aws_iam_policy" "nullplatform_elb_policy" {
           "Effect" : "Allow",
           "Action" : [
             "elasticloadbalancing:DescribeLoadBalancers",
-            "elasticloadbalancing:DescribeTargetGroups"
+            "elasticloadbalancing:DescribeTargetGroups",
+            "elasticloadbalancing:DescribeTargetHealth",
+            "elasticloadbalancing:DescribeListeners",
+            "elasticloadbalancing:DescribeRules"
           ],
           "Resource" : "*",
           "Condition" : {
@@ -113,18 +116,6 @@ resource "aws_iam_policy" "nullplatform_elb_policy" {
               ]
             }
           }
-        },
-        {
-          "Effect" : "Allow",
-          "Action" : [
-            "elasticloadbalancing:DescribeTargetHealth",
-            "elasticloadbalancing:DescribeListeners",
-            "elasticloadbalancing:DescribeRules"
-          ],
-          "Resource" : [
-            "arn:aws:elasticloadbalancing:*:*:loadbalancer/app/k8s-nullplatform-*",
-            "arn:aws:elasticloadbalancing:*:*:targetgroup/k8s-nullplatform-*"
-          ],
         }
       ]
     }