ci(devbox): force-pull latest flyteconsole image when building bundled devbox (#7594)

Signed-off-by: Kevin Su <pingsutw@apache.org>

Author: pingsutw

.github/workflows/flyte-binary-v2.yml

@@ -204,7 +204,11 @@ jobs:
           project: ${{ env.DEPOT_PROJECT_ID }}
           context: docker/devbox-bundled
           platforms: linux/arm64,linux/amd64
-          build-args: "FLYTE_DEVBOX_VERSION=${{ env.FLYTE_DEVBOX_VERSION }}"
+          # CACHEBUST forces the Dockerfile preload layer to re-pull moving tags
+          # (flyteconsole-v2:latest) instead of reusing a stale cached layer.
+          build-args: |
+            FLYTE_DEVBOX_VERSION=${{ env.FLYTE_DEVBOX_VERSION }}
+            CACHEBUST=${{ github.run_id }}-${{ github.run_attempt }}
           save: true
           save-tags: cpu-build-${{ github.run_id }}-${{ github.run_attempt }}
       - name: Authenticate Docker to Depot Registry
@@ -223,7 +227,9 @@ jobs:
           context: docker/devbox-bundled
           platforms: linux/arm64,linux/amd64
           tags: ${{ steps.image-names.outputs.tags }}
-          build-args: "FLYTE_DEVBOX_VERSION=${{ env.FLYTE_DEVBOX_VERSION }}"
+          build-args: |
+            FLYTE_DEVBOX_VERSION=${{ env.FLYTE_DEVBOX_VERSION }}
+            CACHEBUST=${{ github.run_id }}-${{ github.run_attempt }}
           push: true
       - name: Prepare GPU Image Names
         id: gpu-image-names

Makefile

@@ -36,8 +36,8 @@ build: verify ## Build all Go service binaries
 # =============================================================================
 
 .PHONY: devbox-build
-devbox-build: ## Build the flyte devbox image (docker/devbox-bundled)
-	$(MAKE) -C docker/devbox-bundled build
+devbox-build: ## Build the flyte devbox image (docker/devbox-bundled), always re-pulling the latest UI image
+	$(MAKE) -C docker/devbox-bundled build CACHEBUST=$(shell date +%s)
 
 # Run in dev mode with extra arg FLYTE_DEV=True
 .PHONY: devbox-run

docker/devbox-bundled/Dockerfile

@@ -7,7 +7,9 @@ ENV TARGETARCH "${TARGETARCH}"
 WORKDIR /build
 
 COPY images/manifest.txt images/preload ./
-RUN ./preload manifest.txt
+
+ARG CACHEBUST=0
+RUN echo "cachebust=${CACHEBUST}" && ./preload manifest.txt
 
 
 FROM --platform=${BUILDPLATFORM} golang:1.26.3-bookworm AS bootstrap

docker/devbox-bundled/Makefile

@@ -129,6 +129,7 @@ sync-crds:
 build: sync-crds flyte dep_update manifests
 	docker buildx build --builder flyte-devbox --load \
 		$(BUILDX_CACHE_FLAGS) \
+		$(if $(CACHEBUST),--build-arg CACHEBUST=$(CACHEBUST)) \
 		--tag flyte-devbox:latest .
 
 .PHONY: build-gpu

docker/devbox-bundled/manifests/complete.yaml

@@ -7759,6 +7759,20 @@ data:
       k8s:
         co-pilot:
           image: "flyte-binary-v2:sandbox"
+        # Env vars injected into every task pod, so it can reach the control plane
+        # to enqueue child actions and watch their state.
+        #
+        #   - _U_EP_OVERRIDE: where the task reaches the control plane. Defaults to
+        #     this release's in-cluster HTTP service, <fullname>-http.<namespace>:8090.
+        #   - _U_INSECURE: talk plain HTTP — the in-cluster service has no TLS
+        #     (TLS terminates at the ingress).
+        #   - _U_USE_ACTIONS: use the actions/queue execution path.
+        #
+        # Override or extend via configuration.inline.plugins.k8s.default-env-vars.
+        default-env-vars:
+          - _U_EP_OVERRIDE: "flyte-binary-http.flyte:8090"
+          - _U_INSECURE: "true"
+          - _U_USE_ACTIONS: "1"
       k8s-array:
         logs:
           config:
@@ -8614,7 +8628,7 @@ spec:
   template:
     metadata:
       annotations:
-        checksum/configuration: 9ed3014b64700d5fd7df7d19eb0c2cd88291e3c775e0f34e13e3231d82e49234
+        checksum/configuration: b3c98afcd1c1a1aca5040d049159f6a8683facf7875920987bab9a9df6dc8f97
         checksum/configuration-secret: 800f306f43701bd39e3b42e0d756f4627643cf3cee6dbd050a5a57a08052c280
       labels:
         app.kubernetes.io/component: flyte-binary
@@ -9390,6 +9404,10 @@ spec:
     ports:
       web:
         nodePort: 30080
+        # ALB terminates TLS and forwards plaintext to this entrypoint. Trust its
+        # X-Forwarded-Proto: https instead of letting Traefik rewrite it to http.
+        forwardedHeaders:
+          insecure: true
         transport:
           respondingTimeouts:
             readTimeout: 0

docker/devbox-bundled/manifests/dev.yaml

@@ -8894,6 +8894,10 @@ spec:
     ports:
       web:
         nodePort: 30080
+        # ALB terminates TLS and forwards plaintext to this entrypoint. Trust its
+        # X-Forwarded-Proto: https instead of letting Traefik rewrite it to http.
+        forwardedHeaders:
+          insecure: true
         transport:
           respondingTimeouts:
             readTimeout: 0