2026-07-28 21:48:27 +10:00
2 changed files with 6 additions and 1 deletions
@@ -8,7 +8,7 @@ resources:
 helmCharts:
  - name: woodpecker
    repo: oci://ghcr.io/woodpecker-ci/helm
-    version: "3.6.3"
+    version: "3.6.5"
    releaseName: woodpecker
    namespace: woodpecker
    valuesFile: values.yaml
@@ -6,6 +6,11 @@ agent:
    WOODPECKER_BACKEND_K8S_STORAGE_CLASS: cephrbd-fast-delete
    WOODPECKER_BACKEND_K8S_VOLUME_SIZE: 10G
    WOODPECKER_BACKEND_K8S_STORAGE_RWX: false
+    # Required from woodpecker 3.16.0 (GHSA-qf34-295c-26v8): step-level
+    # serviceAccountName is gated behind this agent flag (default false).
+    # The estate's pipelines set backend_options.kubernetes.serviceAccountName
+    # (terraform-* jobs rely on per-SA Vault k8s auth), so keep this enabled.
+    WOODPECKER_BACKEND_K8S_SERVICE_ACCOUNT_NAME_ALLOW_FROM_STEP: "true"
    WOODPECKER_LOG_LEVEL: debug
  #extraSecretNamesForEnvFrom:
  #  - woodpecker-default-agent-secret