unkin/argocd-apps
3
0
Fork 0
Code Issues 7 Pull Requests 2 Actions Packages Projects Releases Wiki Activity

woodpecker: allow CA-baked docker-buildx plugin as privileged #371

Merged
benvin merged 1 commits from benvin/woodpecker-ca-baked-buildx into main 2026-08-15 17:04:40 +10:00
Conversation 0 Commits 1 Files Changed 1
+1 -1
unkin-agent commented 2026-08-15 17:02:06 +10:00
Member
Copy Link
Copy Source

Why: pushing in-house images to the internal-CA artifactapi registry fails x509: certificate signed by unknown authority with the upstream buildx plugin (and :latest-insecure does not fix it — buildkit still verifies the registry cert). The fix is the CA-baked plugin image now published at artifactapi.k8s.syd1.au.unkin.net/docker-internal/plugin-docker-buildx (unkin/plugin-docker-buildx v0.1.0).

How: add that image (bare + :latest) to WOODPECKER_PLUGINS_PRIVILEGED in the au-syd1 overlay so it may run privileged. Existing upstream entries kept so current repos are unaffected until they switch over.

Next: ghp .woodpecker switches its buildx step to this image, then ghp re-tags and its push succeeds.

Why: pushing in-house images to the internal-CA artifactapi registry fails `x509: certificate signed by unknown authority` with the upstream buildx plugin (and `:latest-insecure` does not fix it — buildkit still verifies the registry cert). The fix is the CA-baked plugin image now published at `artifactapi.k8s.syd1.au.unkin.net/docker-internal/plugin-docker-buildx` (unkin/plugin-docker-buildx v0.1.0). How: add that image (bare + `:latest`) to `WOODPECKER_PLUGINS_PRIVILEGED` in the au-syd1 overlay so it may run privileged. Existing upstream entries kept so current repos are unaffected until they switch over. Next: ghp `.woodpecker` switches its buildx step to this image, then ghp re-tags and its push succeeds.
unkin-agent added 1 commit 2026-08-15 17:02:07 +10:00
woodpecker: allow the CA-baked docker-buildx plugin as privileged
ci/woodpecker/pr/vector-test Pipeline was successful
Details
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
ci/woodpecker/pr/kubeconform Pipeline was successful
Details
93467392c4 
Add artifactapi.k8s.syd1.au.unkin.net/docker-internal/plugin-docker-buildx (built
by unkin/plugin-docker-buildx) to WOODPECKER_PLUGINS_PRIVILEGED so in-house repos
can push to the internal-CA artifactapi registry without the x509 failure. The
upstream entries stay listed so existing repos keep working until they migrate.
benvin merged commit 7556d08d06 into main 2026-08-15 17:04:40 +10:00
benvin deleted branch benvin/woodpecker-ca-baked-buildx 2026-08-15 17:04:41 +10:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
benvin (BenVincent) unkin-agent (Unkin Agent) unkinben (Ben Vincent)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unkin/argocd-apps#371
Delete Branch "benvin/woodpecker-ca-baked-buildx"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?