From 58c32c1cb620e34e4a5aac2c9fdbcdaca4fcede0 Mon Sep 17 00:00:00 2001 From: Ben Vincent Date: Mon, 27 Jul 2026 21:55:30 +1000 Subject: [PATCH] Bump Woodpecker CI to v3.16.0 Move the Woodpecker helm chart from 3.6.3 (appVersion 3.14.1) to 3.6.5 (appVersion 3.16.0), upgrading server and agent together. Enable the new agent flag that gates step-level serviceAccountName so existing pipelines keep working. - Bump helmChart version 3.6.3 -> 3.6.5 in the au-syd1 overlay (server + agent both render as v3.16.0 via the chart appVersion). - Set WOODPECKER_BACKEND_K8S_SERVICE_ACCOUNT_NAME_ALLOW_FROM_STEP=true on the agent; 3.16.0 (GHSA-qf34-295c-26v8) gates step-level serviceAccountName behind this flag (default false), and the estate's pipelines set backend_options.kubernetes.serviceAccountName. Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv --- apps/overlays/au-syd1/woodpecker/kustomization.yaml | 2 +- apps/overlays/au-syd1/woodpecker/values.yaml | 5 +++++ 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/apps/overlays/au-syd1/woodpecker/kustomization.yaml b/apps/overlays/au-syd1/woodpecker/kustomization.yaml index 279ae05..4e1618f 100644 --- a/apps/overlays/au-syd1/woodpecker/kustomization.yaml +++ b/apps/overlays/au-syd1/woodpecker/kustomization.yaml @@ -8,7 +8,7 @@ resources: helmCharts: - name: woodpecker repo: oci://ghcr.io/woodpecker-ci/helm - version: "3.6.3" + version: "3.6.5" releaseName: woodpecker namespace: woodpecker valuesFile: values.yaml diff --git a/apps/overlays/au-syd1/woodpecker/values.yaml b/apps/overlays/au-syd1/woodpecker/values.yaml index fd16b7e..57dc0da 100644 --- a/apps/overlays/au-syd1/woodpecker/values.yaml +++ b/apps/overlays/au-syd1/woodpecker/values.yaml @@ -6,6 +6,11 @@ agent: WOODPECKER_BACKEND_K8S_STORAGE_CLASS: cephrbd-fast-delete WOODPECKER_BACKEND_K8S_VOLUME_SIZE: 10G WOODPECKER_BACKEND_K8S_STORAGE_RWX: false + # Required from woodpecker 3.16.0 (GHSA-qf34-295c-26v8): step-level + # serviceAccountName is gated behind this agent flag (default false). + # The estate's pipelines set backend_options.kubernetes.serviceAccountName + # (terraform-* jobs rely on per-SA Vault k8s auth), so keep this enabled. + WOODPECKER_BACKEND_K8S_SERVICE_ACCOUNT_NAME_ALLOW_FROM_STEP: "true" WOODPECKER_LOG_LEVEL: debug #extraSecretNamesForEnvFrom: # - woodpecker-default-agent-secret