unkin-agent
7556d08d06
Why: pushing in-house images to the internal-CA artifactapi registry fails `x509: certificate signed by unknown authority` with the upstream buildx plugin (and `:latest-insecure` does not fix it — buildkit still verifies the registry cert). The fix is the CA-baked plugin image now published at `artifactapi.k8s.syd1.au.unkin.net/docker-internal/plugin-docker-buildx` (unkin/plugin-docker-buildx v0.1.0). How: add that image (bare + `:latest`) to `WOODPECKER_PLUGINS_PRIVILEGED` in the au-syd1 overlay so it may run privileged. Existing upstream entries kept so current repos are unaffected until they switch over. Next: ghp `.woodpecker` switches its buildx step to this image, then ghp re-tags and its push succeeds. Reviewed-on: #371 Co-authored-by: unkin-agent <unkin-agent@unkin.net> Co-committed-by: unkin-agent <unkin-agent@unkin.net>
68 lines
2.3 KiB
YAML
68 lines
2.3 KiB
YAML
agent:
|
|
replicaCount: 3
|
|
env:
|
|
WOODPECKER_MAX_WORKFLOWS: "8"
|
|
WOODPECKER_BACKEND_K8S_PRIORITY_CLASS: power
|
|
WOODPECKER_BACKEND_K8S_STORAGE_CLASS: cephrbd-fast-delete
|
|
WOODPECKER_BACKEND_K8S_VOLUME_SIZE: 10G
|
|
WOODPECKER_BACKEND_K8S_STORAGE_RWX: false
|
|
# Required from woodpecker 3.16.0 (GHSA-qf34-295c-26v8): step-level
|
|
# serviceAccountName is gated behind this agent flag (default false).
|
|
# The estate's pipelines set backend_options.kubernetes.serviceAccountName
|
|
# (terraform-* jobs rely on per-SA Vault k8s auth), so keep this enabled.
|
|
WOODPECKER_BACKEND_K8S_SERVICE_ACCOUNT_NAME_ALLOW_FROM_STEP: "true"
|
|
WOODPECKER_LOG_LEVEL: debug
|
|
#extraSecretNamesForEnvFrom:
|
|
# - woodpecker-default-agent-secret
|
|
persistence:
|
|
storageClass: cephrbd-fast-delete
|
|
podAnnotations:
|
|
configmap.reloader.stakater.com/auto: "true"
|
|
resources:
|
|
requests:
|
|
cpu: 50m
|
|
limits:
|
|
memory: 128Mi
|
|
|
|
server:
|
|
statefulSet:
|
|
replicaCount: 1
|
|
env:
|
|
WOODPECKER_HOST: 'https://ci.k8s.syd1.au.unkin.net'
|
|
WOODPECKER_OPEN: "true"
|
|
WOODPECKER_ADMIN: "unkinben"
|
|
WOODPECKER_DISABLE_USER_AGENT_REGISTRATION: "true"
|
|
WOODPECKER_PLUGINS_PRIVILEGED: "woodpeckerci/plugin-docker-buildx,woodpeckerci/plugin-docker-buildx:latest-insecure,artifactapi.k8s.syd1.au.unkin.net/docker-internal/plugin-docker-buildx,artifactapi.k8s.syd1.au.unkin.net/docker-internal/plugin-docker-buildx:latest"
|
|
extraSecretNamesForEnvFrom:
|
|
- woodpecker-gitea
|
|
- woodpecker-postgres-credentials
|
|
- woodpecker-database-config
|
|
persistentVolume:
|
|
storageClass: cephrbd-fast-delete
|
|
podAnnotations:
|
|
configmap.reloader.stakater.com/auto: "true"
|
|
ingress:
|
|
enabled: true
|
|
annotations:
|
|
cert-manager.io/cluster-issuer: vault-issuer
|
|
cert-manager.io/common-name: ci.k8s.syd1.au.unkin.net
|
|
cert-manager.io/private-key-size: "4096"
|
|
external-dns.alpha.kubernetes.io/hostname: ci.k8s.syd1.au.unkin.net
|
|
external-dns.alpha.kubernetes.io/target: 198.18.200.0
|
|
ingressClassName: nginx
|
|
hosts:
|
|
- host: ci.k8s.syd1.au.unkin.net
|
|
paths:
|
|
- path: /
|
|
backend:
|
|
servicePort: 80
|
|
tls:
|
|
- hosts:
|
|
- ci.k8s.syd1.au.unkin.net
|
|
secretName: ci-tls
|
|
resources:
|
|
requests:
|
|
cpu: 100m
|
|
limits:
|
|
memory: 128Mi
|