From 7556d08d0680fd88aaea8ba2dbf82120686a7f1d Mon Sep 17 00:00:00 2001 From: unkin-agent Date: Sat, 15 Aug 2026 17:04:40 +1000 Subject: [PATCH] woodpecker: allow CA-baked docker-buildx plugin as privileged (#371) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Why: pushing in-house images to the internal-CA artifactapi registry fails `x509: certificate signed by unknown authority` with the upstream buildx plugin (and `:latest-insecure` does not fix it — buildkit still verifies the registry cert). The fix is the CA-baked plugin image now published at `artifactapi.k8s.syd1.au.unkin.net/docker-internal/plugin-docker-buildx` (unkin/plugin-docker-buildx v0.1.0). How: add that image (bare + `:latest`) to `WOODPECKER_PLUGINS_PRIVILEGED` in the au-syd1 overlay so it may run privileged. Existing upstream entries kept so current repos are unaffected until they switch over. Next: ghp `.woodpecker` switches its buildx step to this image, then ghp re-tags and its push succeeds. Reviewed-on: https://git.unkin.net/unkin/argocd-apps/pulls/371 Co-authored-by: unkin-agent Co-committed-by: unkin-agent --- apps/overlays/au-syd1/woodpecker/values.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apps/overlays/au-syd1/woodpecker/values.yaml b/apps/overlays/au-syd1/woodpecker/values.yaml index a448dfb..e3adc5f 100644 --- a/apps/overlays/au-syd1/woodpecker/values.yaml +++ b/apps/overlays/au-syd1/woodpecker/values.yaml @@ -32,7 +32,7 @@ server: WOODPECKER_OPEN: "true" WOODPECKER_ADMIN: "unkinben" WOODPECKER_DISABLE_USER_AGENT_REGISTRATION: "true" - WOODPECKER_PLUGINS_PRIVILEGED: "woodpeckerci/plugin-docker-buildx,woodpeckerci/plugin-docker-buildx:latest-insecure" + WOODPECKER_PLUGINS_PRIVILEGED: "woodpeckerci/plugin-docker-buildx,woodpeckerci/plugin-docker-buildx:latest-insecure,artifactapi.k8s.syd1.au.unkin.net/docker-internal/plugin-docker-buildx,artifactapi.k8s.syd1.au.unkin.net/docker-internal/plugin-docker-buildx:latest" extraSecretNamesForEnvFrom: - woodpecker-gitea - woodpecker-postgres-credentials