From d1a7646e09a7ea7917083914cc1300ffc87408e6 Mon Sep 17 00:00:00 2001 From: Ben Vincent Date: Tue, 28 Jul 2026 21:48:26 +1000 Subject: [PATCH] Bump Woodpecker CI to v3.16.0 (#297) ## Why Upgrade the Woodpecker CI instance from v3.14.1 to v3.16.0 to pick up upstream fixes and the k8s-backend privilege-escalation hardening (GHSA-qf34-295c-26v8). Server and agent must move together. The chart is pulled at build time (`kustomize build --enable-helm`); the image tag defaults to the chart `appVersion`, so bumping the chart moves both images. Chart 3.6.5 -> appVersion 3.16.0 (verified against upstream `helm/charts/woodpecker/Chart.yaml`); subchart deps are unchanged from 3.6.3 (server 3.0.1, agent 2.0.1), so there is no values-schema migration. ## What - Bump the woodpecker helmChart from `3.6.3` (appVersion 3.14.1) to `3.6.5` (appVersion 3.16.0) in the au-syd1 overlay. Server + agent both render as `v3.16.0`. - Set `WOODPECKER_BACKEND_K8S_SERVICE_ACCOUNT_NAME_ALLOW_FROM_STEP: "true"` on the agent. ## CRITICAL: k8s backend serviceAccountName gating (required change) v3.16.0 (PR #6792, GHSA-qf34-295c-26v8) gates step-level `serviceAccountName` behind a new agent flag `WOODPECKER_BACKEND_K8S_SERVICE_ACCOUNT_NAME_ALLOW_FROM_STEP`, **default `false`**. When disabled, any `backend_options.kubernetes.serviceAccountName` set by a pipeline is **silently ignored** and the namespace `default` SA is used instead. Every terraform pipeline in the estate sets `backend_options.kubernetes.serviceAccountName` (e.g. `terraform-git`, `terraform-vault`, `terraform-artifactapi`) and relies on that SA for Vault k8s auth / Consul state. Without this flag those jobs would run as `default` and lose their Vault identity. This PR sets the flag to `true` to preserve current behaviour. No other newly-gated backend_options keys (pod labels/annotations from step, native secrets) are used by the estate. ## Migration / rollback - **DB migration:** Woodpecker auto-migrates the schema (xorm) on server start; migrations are forward-only and NOT reversible. The 3.14 -> 3.16 changelogs do not call out a data-destructive migration, but a **DB backup (CNPG cluster `woodpecker`) should be taken before merge**. - **In-flight pipelines:** merging rolls the server StatefulSet and agents; any running pipelines are interrupted and will need re-running. - **Rollback:** re-pin chart `3.6.5` -> `3.6.3` reverts the images to v3.14.1, but because migrations are one-way, a clean rollback requires **restoring the CNPG DB from the pre-merge backup**, not just pinning the old image. ## Validation - `kustomize build --enable-helm apps/overlays/au-syd1/woodpecker` renders `woodpecker-server:v3.16.0` and `woodpecker-agent:v3.16.0`; agent carries the new env var. - `kubeconform` (k8s 1.33.7): 24/24 resources valid. - pre-commit (yamllint + checks): all pass. ## Follow-up (not in this PR) Woodpecker images are pulled from `docker.io` / `ghcr.io` directly, not the artifactapi proxy. Proxying them via artifactapi is a possible follow-up but out of scope for this version bump. https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv Reviewed-on: https://git.unkin.net/unkin/argocd-apps/pulls/297 Co-authored-by: Ben Vincent Co-committed-by: Ben Vincent --- apps/overlays/au-syd1/woodpecker/kustomization.yaml | 2 +- apps/overlays/au-syd1/woodpecker/values.yaml | 5 +++++ 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/apps/overlays/au-syd1/woodpecker/kustomization.yaml b/apps/overlays/au-syd1/woodpecker/kustomization.yaml index 279ae05..4e1618f 100644 --- a/apps/overlays/au-syd1/woodpecker/kustomization.yaml +++ b/apps/overlays/au-syd1/woodpecker/kustomization.yaml @@ -8,7 +8,7 @@ resources: helmCharts: - name: woodpecker repo: oci://ghcr.io/woodpecker-ci/helm - version: "3.6.3" + version: "3.6.5" releaseName: woodpecker namespace: woodpecker valuesFile: values.yaml diff --git a/apps/overlays/au-syd1/woodpecker/values.yaml b/apps/overlays/au-syd1/woodpecker/values.yaml index fd16b7e..57dc0da 100644 --- a/apps/overlays/au-syd1/woodpecker/values.yaml +++ b/apps/overlays/au-syd1/woodpecker/values.yaml @@ -6,6 +6,11 @@ agent: WOODPECKER_BACKEND_K8S_STORAGE_CLASS: cephrbd-fast-delete WOODPECKER_BACKEND_K8S_VOLUME_SIZE: 10G WOODPECKER_BACKEND_K8S_STORAGE_RWX: false + # Required from woodpecker 3.16.0 (GHSA-qf34-295c-26v8): step-level + # serviceAccountName is gated behind this agent flag (default false). + # The estate's pipelines set backend_options.kubernetes.serviceAccountName + # (terraform-* jobs rely on per-SA Vault k8s auth), so keep this enabled. + WOODPECKER_BACKEND_K8S_SERVICE_ACCOUNT_NAME_ALLOW_FROM_STEP: "true" WOODPECKER_LOG_LEVEL: debug #extraSecretNamesForEnvFrom: # - woodpecker-default-agent-secret