From d25aae97ddf6a7875287cbaf1c6378c1ad1d15e7 Mon Sep 17 00:00:00 2001 From: serialito74 Date: Tue, 25 Aug 2026 12:44:14 -0300 Subject: [PATCH 1/2] fix(istio): read create-time values from parameters, not stale attributes build_context checked .service.attributes.X // .parameters.X, but on a create action .service.attributes already exists with empty-string values (not null) for every schema property, so jq's // never falls through to .parameters - the just-submitted form values (base_domain, path_prefix, scope) are silently discarded and the action fails with "base_domain is required" even when the field is explicitly filled in the UI. Switched to a merge where parameters win, which still resolves correctly on update actions (unset parameters fall back to the already- persisted service attributes). --- scripts/istio/build_context | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) diff --git a/scripts/istio/build_context b/scripts/istio/build_context index 95e0930..938b8f2 100755 --- a/scripts/istio/build_context +++ b/scripts/istio/build_context @@ -7,10 +7,17 @@ ACTION_ID=$(echo "$CONTEXT" | jq -r '.id') ACTION_NAME=$(echo "$CONTEXT" | jq -r '.slug') APPLICATION_ID=$(echo "$CONTEXT" | jq -r '.tags.application_id // ""') -BASE_DOMAIN=$(echo "$CONTEXT" | jq -r '.service.attributes.base_domain // .parameters.base_domain // ""') -STRIP_PREFIX=$(echo "$CONTEXT" | jq -r '.service.attributes.strip_prefix // .parameters.strip_prefix // "true"') -PATH_PREFIX=$(echo "$CONTEXT" | jq -r '.service.attributes.path_prefix // .parameters.path_prefix // ""') -SCOPE_SLUG=$(echo "$CONTEXT" | jq -r '.service.attributes.scope // .parameters.scope // ""') +# Merge service attributes with parameters, parameters win - on the first +# create action .service.attributes already exists with empty-string +# values (not null) for every schema property, so a plain +# `.service.attributes.x // .parameters.x` never falls through to +# parameters (jq's // only falls back on null/false, not on ""). +SERVICE_ATTRS=$(echo "$CONTEXT" | jq -c '(.service.attributes // {}) * (.parameters // {})') + +BASE_DOMAIN=$(echo "$SERVICE_ATTRS" | jq -r '.base_domain // ""') +STRIP_PREFIX=$(echo "$SERVICE_ATTRS" | jq -r '.strip_prefix // "true"') +PATH_PREFIX=$(echo "$SERVICE_ATTRS" | jq -r '.path_prefix // ""') +SCOPE_SLUG=$(echo "$SERVICE_ATTRS" | jq -r '.scope // ""') [[ -z "$BASE_DOMAIN" ]] && { echo "ERROR: base_domain is required in service attributes"; exit 1; } [[ -z "$PATH_PREFIX" ]] && { echo "ERROR: path_prefix is required in service attributes"; exit 1; } From e31df444365e3fdd40e5762c6ab4c9174cd16440 Mon Sep 17 00:00:00 2001 From: serialito74 Date: Tue, 25 Aug 2026 13:24:39 -0300 Subject: [PATCH 2/2] fix(istio): read action identity/parameters from ACTION_* env vars Verified live against a real cluster that the previous commit's merge fix (parameters win over stale attributes) was not actually the root cause: $CONTEXT (from `--build-context`) never carries the action's own id/slug/parameters/service data at all on the currently-shipping np CLI - that JSON only carries related entities (scope/application/ namespace/account; "service" isn't even a valid --include resource). Confirmed via a full env-var-name dump on a live failed action that the action's own identity and submitted create-form values arrive as flat ACTION_* environment variables instead, set directly by `np service workflow exec` (ACTION_PARAMETERS_BASE_DOMAIN, ACTION_SERVICE_ID, ACTION_ENTITY_NRN, ACTION_SERVICE_DIMENSIONS_ENVIRONMENT, etc.) - not through $CONTEXT at all. - build_context: read SERVICE_ID/SERVICE_SLUG/ACTION_ID/ACTION_NAME/ APPLICATION_ID/BASE_DOMAIN/STRIP_PREFIX/PATH_PREFIX/SCOPE_SLUG directly from the corresponding ACTION_* env vars. - fetch_provider_data: same root cause was behind a `jq: null has no keys` error on every single run (.service.dimensions/.entity_nrn don't exist in $CONTEXT either). Reads ACTION_ENTITY_NRN and ACTION_SERVICE_DIMENSIONS_ENVIRONMENT instead. End-to-end verified: a real create action now completes successfully and the HTTPRoute gets applied to the cluster. --- scripts/istio/build_context | 33 ++++++++++++++++--------------- scripts/istio/fetch_provider_data | 13 ++++++++---- 2 files changed, 26 insertions(+), 20 deletions(-) diff --git a/scripts/istio/build_context b/scripts/istio/build_context index 938b8f2..99cac18 100755 --- a/scripts/istio/build_context +++ b/scripts/istio/build_context @@ -1,23 +1,24 @@ #!/bin/bash set -euo pipefail -SERVICE_ID=$(echo "$CONTEXT" | jq -r '.service.id') -SERVICE_SLUG=$(echo "$CONTEXT" | jq -r '.service.slug') -ACTION_ID=$(echo "$CONTEXT" | jq -r '.id') -ACTION_NAME=$(echo "$CONTEXT" | jq -r '.slug') -APPLICATION_ID=$(echo "$CONTEXT" | jq -r '.tags.application_id // ""') +# This np CLI version does NOT expose the action's own id/slug/parameters +# through the $CONTEXT built by `--build-context` - that JSON only carries +# related entities (scope/application/namespace/account, per its --include +# list, which doesn't even have "service" as an option). The action's own +# identity and submitted create-form values arrive as flat ACTION_* env +# vars instead, set directly by `np service workflow exec` (confirmed live +# via a real failed action: ACTION_PARAMETERS_BASE_DOMAIN etc. were present +# and correct while $CONTEXT had none of this). +SERVICE_ID="$ACTION_SERVICE_ID" +SERVICE_SLUG="$ACTION_SERVICE_SLUG" +ACTION_ID="$ACTION_ID" +ACTION_NAME="$ACTION_SLUG" +APPLICATION_ID="${ACTION_TAGS_APPLICATION_ID:-}" -# Merge service attributes with parameters, parameters win - on the first -# create action .service.attributes already exists with empty-string -# values (not null) for every schema property, so a plain -# `.service.attributes.x // .parameters.x` never falls through to -# parameters (jq's // only falls back on null/false, not on ""). -SERVICE_ATTRS=$(echo "$CONTEXT" | jq -c '(.service.attributes // {}) * (.parameters // {})') - -BASE_DOMAIN=$(echo "$SERVICE_ATTRS" | jq -r '.base_domain // ""') -STRIP_PREFIX=$(echo "$SERVICE_ATTRS" | jq -r '.strip_prefix // "true"') -PATH_PREFIX=$(echo "$SERVICE_ATTRS" | jq -r '.path_prefix // ""') -SCOPE_SLUG=$(echo "$SERVICE_ATTRS" | jq -r '.scope // ""') +BASE_DOMAIN="${ACTION_PARAMETERS_BASE_DOMAIN:-}" +STRIP_PREFIX="${ACTION_PARAMETERS_STRIP_PREFIX:-true}" +PATH_PREFIX="${ACTION_PARAMETERS_PATH_PREFIX:-}" +SCOPE_SLUG="${ACTION_PARAMETERS_SCOPE:-}" [[ -z "$BASE_DOMAIN" ]] && { echo "ERROR: base_domain is required in service attributes"; exit 1; } [[ -z "$PATH_PREFIX" ]] && { echo "ERROR: path_prefix is required in service attributes"; exit 1; } diff --git a/scripts/istio/fetch_provider_data b/scripts/istio/fetch_provider_data index f3fcbbe..ceece1a 100755 --- a/scripts/istio/fetch_provider_data +++ b/scripts/istio/fetch_provider_data @@ -3,11 +3,16 @@ # Fetch Provider Data: Retrieves Kubernetes namespace from the container orchestration provider. # Queries provider data based on service dimensions and exports K8S_NAMESPACE for downstream scripts. -NRN=$(echo "$CONTEXT" | jq -r .entity_nrn) +# $CONTEXT (from --build-context) doesn't carry the action's own entity_nrn +# or service dimensions on this np CLI version - use the flat ACTION_* env +# vars the workflow executor sets directly instead (see build_context for +# how this was confirmed against a real action). +NRN="${ACTION_ENTITY_NRN:-}" -DIMENSIONS=$(echo "$CONTEXT" | jq .service.dimensions) - -DIMENSION_FILTER=$(echo "$DIMENSIONS" | jq -r 'to_entries | map("\(.key):\(.value)") | join(",")') +DIMENSION_FILTER="" +if [ -n "${ACTION_SERVICE_DIMENSIONS_ENVIRONMENT:-}" ]; then + DIMENSION_FILTER="environment:${ACTION_SERVICE_DIMENSIONS_ENVIRONMENT}" +fi if [ -z "$DIMENSION_FILTER" ] || [ "$DIMENSION_FILTER" = "" ]; then PROVIDER_DATA=$(np provider list --categories container-orchestration --nrn "$NRN" --format json | jq -r ".results[0]")