init: CA-baked woodpecker docker-buildx plugin image #1

2026-08-15T16:21:20+10:00

unkin-agent commented

2026-08-15 16:21:20 +10:00

Why: the k8s woodpecker backend cannot inject files/volumes into plugin containers, so woodpeckerci/plugin-docker-buildx has no way to trust artifactapi's internal-CA registry — every in-house image push fails x509: certificate signed by unknown authority. :latest-insecure does not fix it (buildkit still verifies the registry cert on push).

How: bake the unkin CA into the plugin image.

Dockerfile: FROM woodpeckerci/plugin-docker-buildx:latest, COPY the 2-cert unkin CA chain to /etc/docker/certs.d/artifactapi.k8s.syd1.au.unkin.net/ca.crt (buildkit registry trust) + system trust store.
.woodpecker/{build,release}.yaml: buildah (vfs+chroot, unprivileged) builds on PR, builds+pushes to artifactapi.k8s.syd1.au.unkin.net/docker-internal/plugin-docker-buildx on v* tags. --tls-verify=false is a deliberate bootstrap — this image is what establishes the trust its own push would otherwise need.
serviceAccountName plugin-docker-buildx + resources on every step.

Follow-ups after merge+tag: point WOODPECKER_PLUGINS_PRIVILEGED at docker-internal/plugin-docker-buildx (argocd), switch in-house repo pipelines to it, re-tag ghp so its push succeeds.

Why: the k8s woodpecker backend cannot inject files/volumes into plugin containers, so `woodpeckerci/plugin-docker-buildx` has no way to trust artifactapi's internal-CA registry — every in-house image push fails `x509: certificate signed by unknown authority`. `:latest-insecure` does not fix it (buildkit still verifies the registry cert on push). How: bake the unkin CA into the plugin image. - Dockerfile: FROM woodpeckerci/plugin-docker-buildx:latest, COPY the 2-cert unkin CA chain to /etc/docker/certs.d/artifactapi.k8s.syd1.au.unkin.net/ca.crt (buildkit registry trust) + system trust store. - .woodpecker/{build,release}.yaml: buildah (vfs+chroot, unprivileged) builds on PR, builds+pushes to artifactapi.k8s.syd1.au.unkin.net/docker-internal/plugin-docker-buildx on v* tags. --tls-verify=false is a deliberate bootstrap — this image is what establishes the trust its own push would otherwise need. - serviceAccountName plugin-docker-buildx + resources on every step. Follow-ups after merge+tag: point WOODPECKER_PLUGINS_PRIVILEGED at docker-internal/plugin-docker-buildx (argocd), switch in-house repo pipelines to it, re-tag ghp so its push succeeds.

unkin-agent added 1 commit 2026-08-15 16:21:20 +10:00

Add CA-baked plugin-docker-buildx image + buildah CI b13a8cec78

Bake the internal Vault-PKI CA into a rebuild of
woodpeckerci/plugin-docker-buildx so k8s buildx jobs can push to
artifactapi's docker-internal registry over TLS.

- Dockerfile: copy unkin-ca.crt into /etc/docker/certs.d/<registry>/ca.crt
  and the system trust store
- unkin-ca.crt: vault-ca-cert bundle (root + intermediate)
- .woodpecker/build.yaml: PR gate, buildah build-only
- .woodpecker/release.yaml: on v* tag, buildah build + credless push to
  docker-internal with --tls-verify=false (bootstrap)

unkin-agent referenced this pull request from unkin/argocd-apps

2026-08-15 16:22:07 +10:00

woodpecker: add plugin-docker-buildx CI ServiceAccount #368

unkin-agent added 1 commit 2026-08-15 16:26:39 +10:00

woodpecker: quote buildah commands (YAML colon-space parse fix)

ci/woodpecker/pr/build Pipeline failed

Details

7f3adc5725

woodpecker interpolates ${CI_COMMIT_TAG} into the raw pipeline text before YAML
parsing; when empty, '-t $${IMG}:${CI_COMMIT_TAG} .' collapses to '... : .'
and the colon-space is parsed as a map key ('cannot unmarshal map ... into a
string value'). Quote every buildah command so it stays a scalar.

benvin referenced this issue from a commit

2026-08-15 16:26:52 +10:00

woodpecker: add plugin-docker-buildx CI ServiceAccount (#368)

unkin-agent added 1 commit 2026-08-15 16:31:25 +10:00

ci: re-trigger build (plugin-docker-buildx SA now exists via argocd-apps#368)

ci/woodpecker/pr/build Pipeline failed

Details

6fd0c6efba

unkin-agent added 1 commit 2026-08-15 16:34:03 +10:00

Dockerfile: fully-qualify base image (buildah short-name TTY fix)

ci/woodpecker/pr/build Pipeline was successful

Details

5977527348

buildah (quay.io/buildah/stable) enforces short-name resolution and cannot
prompt without a TTY, so 'FROM woodpeckerci/plugin-docker-buildx:latest' errors.
Qualify as docker.io/... . Keep it on docker.io (public CA) deliberately: this
image is what bootstraps internal-CA trust, so pulling its own base through the
internal-CA artifactapi registry would reintroduce the x509 problem in-build.

benvin merged commit ce6ab41dc2 into main

2026-08-15 16:37:49 +10:00

benvin deleted branch benvin/init

2026-08-15 16:37:49 +10:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: unkin/plugin-docker-buildx#1