unkin/argocd-apps
3
0
Fork 0
Code Issues 7 Pull Requests 2 Actions Packages Projects Releases Wiki Activity

Bump Woodpecker CI to v3.16.0 #297

Merged
benvin merged 1 commits from benvin/woodpecker-3.16.0 into main 2026-07-28 21:48:27 +10:00
Conversation 0 Commits 1 Files Changed 2
+6 -1
unkinben commented 2026-07-27 21:56:05 +10:00
Owner
Copy Link
Copy Source

Why

Upgrade the Woodpecker CI instance from v3.14.1 to v3.16.0 to pick up upstream fixes and the k8s-backend privilege-escalation hardening (GHSA-qf34-295c-26v8). Server and agent must move together.

The chart is pulled at build time (kustomize build --enable-helm); the image tag defaults to the chart appVersion, so bumping the chart moves both images. Chart 3.6.5 -> appVersion 3.16.0 (verified against upstream helm/charts/woodpecker/Chart.yaml); subchart deps are unchanged from 3.6.3 (server 3.0.1, agent 2.0.1), so there is no values-schema migration.

What

  • Bump the woodpecker helmChart from 3.6.3 (appVersion 3.14.1) to 3.6.5 (appVersion 3.16.0) in the au-syd1 overlay. Server + agent both render as v3.16.0.
  • Set WOODPECKER_BACKEND_K8S_SERVICE_ACCOUNT_NAME_ALLOW_FROM_STEP: "true" on the agent.

CRITICAL: k8s backend serviceAccountName gating (required change)

v3.16.0 (PR #6792, GHSA-qf34-295c-26v8) gates step-level serviceAccountName behind a new agent flag WOODPECKER_BACKEND_K8S_SERVICE_ACCOUNT_NAME_ALLOW_FROM_STEP, default false. When disabled, any backend_options.kubernetes.serviceAccountName set by a pipeline is silently ignored and the namespace default SA is used instead.

Every terraform pipeline in the estate sets backend_options.kubernetes.serviceAccountName (e.g. terraform-git, terraform-vault, terraform-artifactapi) and relies on that SA for Vault k8s auth / Consul state. Without this flag those jobs would run as default and lose their Vault identity. This PR sets the flag to true to preserve current behaviour. No other newly-gated backend_options keys (pod labels/annotations from step, native secrets) are used by the estate.

Migration / rollback

  • DB migration: Woodpecker auto-migrates the schema (xorm) on server start; migrations are forward-only and NOT reversible. The 3.14 -> 3.16 changelogs do not call out a data-destructive migration, but a DB backup (CNPG cluster woodpecker) should be taken before merge.
  • In-flight pipelines: merging rolls the server StatefulSet and agents; any running pipelines are interrupted and will need re-running.
  • Rollback: re-pin chart 3.6.5 -> 3.6.3 reverts the images to v3.14.1, but because migrations are one-way, a clean rollback requires restoring the CNPG DB from the pre-merge backup, not just pinning the old image.

Validation

  • kustomize build --enable-helm apps/overlays/au-syd1/woodpecker renders woodpecker-server:v3.16.0 and woodpecker-agent:v3.16.0; agent carries the new env var.
  • kubeconform (k8s 1.33.7): 24/24 resources valid.
  • pre-commit (yamllint + checks): all pass.

Follow-up (not in this PR)

Woodpecker images are pulled from docker.io / ghcr.io directly, not the artifactapi proxy. Proxying them via artifactapi is a possible follow-up but out of scope for this version bump.

https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv

## Why Upgrade the Woodpecker CI instance from v3.14.1 to v3.16.0 to pick up upstream fixes and the k8s-backend privilege-escalation hardening (GHSA-qf34-295c-26v8). Server and agent must move together. The chart is pulled at build time (`kustomize build --enable-helm`); the image tag defaults to the chart `appVersion`, so bumping the chart moves both images. Chart 3.6.5 -> appVersion 3.16.0 (verified against upstream `helm/charts/woodpecker/Chart.yaml`); subchart deps are unchanged from 3.6.3 (server 3.0.1, agent 2.0.1), so there is no values-schema migration. ## What - Bump the woodpecker helmChart from `3.6.3` (appVersion 3.14.1) to `3.6.5` (appVersion 3.16.0) in the au-syd1 overlay. Server + agent both render as `v3.16.0`. - Set `WOODPECKER_BACKEND_K8S_SERVICE_ACCOUNT_NAME_ALLOW_FROM_STEP: "true"` on the agent. ## CRITICAL: k8s backend serviceAccountName gating (required change) v3.16.0 (PR #6792, GHSA-qf34-295c-26v8) gates step-level `serviceAccountName` behind a new agent flag `WOODPECKER_BACKEND_K8S_SERVICE_ACCOUNT_NAME_ALLOW_FROM_STEP`, **default `false`**. When disabled, any `backend_options.kubernetes.serviceAccountName` set by a pipeline is **silently ignored** and the namespace `default` SA is used instead. Every terraform pipeline in the estate sets `backend_options.kubernetes.serviceAccountName` (e.g. `terraform-git`, `terraform-vault`, `terraform-artifactapi`) and relies on that SA for Vault k8s auth / Consul state. Without this flag those jobs would run as `default` and lose their Vault identity. This PR sets the flag to `true` to preserve current behaviour. No other newly-gated backend_options keys (pod labels/annotations from step, native secrets) are used by the estate. ## Migration / rollback - **DB migration:** Woodpecker auto-migrates the schema (xorm) on server start; migrations are forward-only and NOT reversible. The 3.14 -> 3.16 changelogs do not call out a data-destructive migration, but a **DB backup (CNPG cluster `woodpecker`) should be taken before merge**. - **In-flight pipelines:** merging rolls the server StatefulSet and agents; any running pipelines are interrupted and will need re-running. - **Rollback:** re-pin chart `3.6.5` -> `3.6.3` reverts the images to v3.14.1, but because migrations are one-way, a clean rollback requires **restoring the CNPG DB from the pre-merge backup**, not just pinning the old image. ## Validation - `kustomize build --enable-helm apps/overlays/au-syd1/woodpecker` renders `woodpecker-server:v3.16.0` and `woodpecker-agent:v3.16.0`; agent carries the new env var. - `kubeconform` (k8s 1.33.7): 24/24 resources valid. - pre-commit (yamllint + checks): all pass. ## Follow-up (not in this PR) Woodpecker images are pulled from `docker.io` / `ghcr.io` directly, not the artifactapi proxy. Proxying them via artifactapi is a possible follow-up but out of scope for this version bump. https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv
unkinben added 1 commit 2026-07-27 21:56:05 +10:00
Bump Woodpecker CI to v3.16.0
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
ci/woodpecker/pr/kubeconform Pipeline was successful
Details
58c32c1cb6 
Move the Woodpecker helm chart from 3.6.3 (appVersion 3.14.1) to 3.6.5
(appVersion 3.16.0), upgrading server and agent together. Enable the new
agent flag that gates step-level serviceAccountName so existing pipelines
keep working.

- Bump helmChart version 3.6.3 -> 3.6.5 in the au-syd1 overlay (server +
  agent both render as v3.16.0 via the chart appVersion).
- Set WOODPECKER_BACKEND_K8S_SERVICE_ACCOUNT_NAME_ALLOW_FROM_STEP=true on
  the agent; 3.16.0 (GHSA-qf34-295c-26v8) gates step-level
  serviceAccountName behind this flag (default false), and the estate's
  pipelines set backend_options.kubernetes.serviceAccountName.

Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv
benvin merged commit d1a7646e09 into main 2026-07-28 21:48:27 +10:00
benvin deleted branch benvin/woodpecker-3.16.0 2026-07-28 21:48:27 +10:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
benvin (BenVincent) unkin-agent (Unkin Agent) unkinben (Ben Vincent)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unkin/argocd-apps#297
Delete Branch "benvin/woodpecker-3.16.0"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?