\n\ni did attempt `pull_5323-alpine` as recomended in #5238 but it didnt work. the pod never stood up.\n\n### Steps to reproduce\n\n1. install woodpecker (using longhorn as a storage backend and forgejo as a forge but that hasnt been an issue before) on k3s cluster.\n2. create pipeline.\n3. attempt to run it.\n4. will never complete pod creation.\n\n### Expected behavior\n\ncreates pod, and run pipeline\n\n### System Info\n\n```shell\nsource\t\"https://github.com/woodpecker-ci/woodpecker\"\nversion\t\"3.8.0\"\n```\n\n### Additional context\n\n\u003Cimg width=\"1875\" height=\"143\" alt=\"Image\" src=\"https://github.com/user-attachments/assets/6fbbcd41-751c-4d5d-b852-f05e57d6ca12\" />\n\n\u003Cimg width=\"1008\" height=\"312\" alt=\"Image\" src=\"https://github.com/user-attachments/assets/6fc6001e-01e4-4cce-b9c4-2ccc144b9b1a\" />\n\n### Validations\n\n- [x] Read the [docs](https://woodpecker-ci.org/docs/intro).\n- [x] Check that there isn't [already an issue](https://github.com/woodpecker-ci/woodpecker/issues) that reports the same bug to avoid creating a duplicate.\n- [x] Checked that the bug isn't fixed in the `next` version already [https://woodpecker-ci.org/versions]",[3078],{"name":3020,"color":3021},5345,"Kubernetes Pod never completes initialisation - hangs forever","2025-07-21T14:12:00Z","https://github.com/woodpecker-ci/woodpecker/issues/5345",0.7795738,{"description":3085,"labels":3086,"number":3093,"owner":3026,"repository":3027,"state":3094,"title":3095,"updated_at":3096,"url":3097,"score":3098},"https://woodpecker-ci.org/docs/next/administration/backends/ does not contain a Kubernetes section!",[3087,3090],{"name":3088,"color":3089},"documentation","7D625D",{"name":3091,"color":3092},"good first issue","76ea72",1809,"closed","document Kubernetes backend","2023-06-03T22:50:09Z","https://github.com/woodpecker-ci/woodpecker/issues/1809",0.7198276,{"description":3100,"labels":3101,"number":3103,"owner":3026,"repository":3027,"state":3094,"title":3104,"updated_at":3105,"url":3106,"score":3107},"### Component\n\nagent\n\n### Describe the bug\n\n### The bug\r\n\r\nI want to build and push an OCI image (aka docker image) on my self-hosted registry. I'm running Woodpecker with Kubernetes backend.\r\n\r\nI have this error : `x509: certificate signed by unknown authority`.\r\n\r\n### Explanation\r\n\r\nThe `docker build` is not aware of my `ca.crt` file.\r\n\r\n### How to fix the bug\r\n\r\n1. Find a way to provide my `ca.crt` to the agent (easy to do, need a little hack of the helm chart)\r\n2. Find a way for the agent to provide that `ca.crt` to plugins like _plugin-docker-buildx_ (like `WOODPECKER_BACKEND_DOCKER_VOLUMES` but that does not work with Kubernetes backend)\r\n\r\n### What I did, what I tried...\r\n\r\nI have read a lot of documentation on how to build+push my image. I have also read some parts of source code of Woodpecker Kubernetes backend. I have hacked the helm chart in order to put my ca.crt in a ConfigMap and mount it (with success) in either the agent pod or the dind pod (I will probably do a PR for this in repo woodpecker-ci/helm). \r\n\r\nI have tried with `WOODPECKER_BACKEND_DOCKER_VOLUMES` variable but this is restricted to Docker backend. I found nothing similar for Kubernetes.\r\n\r\nAt last, it does not work whatever I do.\r\n\r\nMy favorite try (with and without dind enabled) :\r\n```\r\n publish-woodpecker-branch:\r\n image: woodpeckerci/plugin-docker-buildx\r\n settings:\r\n registry: myregistry:5001\r\n logins:\r\n - registry: https://myregistry:5001/v2\r\n repo: myregistry:5001/awesome/tool\r\n platforms: linux/arm64\r\n tags:\r\n - ${CI_COMMIT_TAG=build}-${CI_COMMIT_SHA:0:8}-arm64\r\n```\r\n\r\nThis should work but I fail at mounting the ConfigMap in the plugin-docker-buildx pod.\r\n\r\nAnother try (too complex I guess):\r\n\r\n```\r\n publish-woodpecker-branch:\r\n image: docker:20.10.12-dind\r\n secrets:\r\n - registry_ca_crt\r\n commands:\r\n - mkdir -p \"/etc/docker/myregistry:5001\"\r\n - echo \"$${REGISTRY_CA_CRT}\" > \"/etc/docker/myregistry:5001/ca.crt\"\r\n - docker build -t \"myregistry:5001/awesome/tool:$${CI_COMMIT_TAG=build}-$${CI_COMMIT_SHA:0:8}-arm64\" .\r\n - docker push \"myregistry:5001/awesome/tool:$${CI_COMMIT_TAG=build}-$${CI_COMMIT_SHA:0:8}-arm64\"\r\n volumes:\r\n - /var/run/docker.sock:/var/run/docker.sock\r\n```\r\n\r\nI get this error : `Cannot connect to the Docker daemon at unix:///var/run/docker.sock. Is the docker daemon running?`\r\n\r\nI have also tried with Podman but I'm getting problems to run in privileged mode.\r\n\n\n### System Info\n\n```shell\n### Version\r\n\r\n\r\n{\"source\":\"https://github.com/woodpecker-ci/woodpecker\",\"version\":\"next-3033abc3\"}\r\n```\r\n\r\n### Helm values\r\n\r\nNotice the hack with `extraVolumes` and `extraVolumeMounts`. `registry-ca-crt` is a ConfigMap that contains a key named `ca.crt` and the value is the CA certificate.\r\n\r\n```\r\n---\r\nserver:\r\n image:\r\n tag: next-3033abc3b4\r\n env:\r\n WOODPECKER_ADMIN: \"\u003Credacted>\"\r\n WOODPECKER_HOST: \"http://woodpecker.\u003Credacted>\"\r\n WOODPECKER_GITEA_URL: \"http://gitea.\u003Credacted>\"\r\n WOODPECKER_GITEA: \"true\"\r\n WOODPECKER_GITEA_SKIP_VERIFY: \"true\"\r\n WOODPECKER_OPEN: \"true\"\r\n WOODPECKER_ORGS: \"\u003Credacted>\"\r\n\r\n extraSecretNamesForEnvFrom:\r\n - woodpecker-gitea-client\r\n - woodpecker-gitea-secret\r\n - woodpecker-secret\r\n\r\n fullnameOverride: \"woodpecker\"\r\n\r\n persistentVolume:\r\n enabled: true\r\n size: 10Gi\r\n storageClass: \"\u003Credacted>\"\r\n\r\nagent:\r\n image:\r\n tag: next-3033abc3b4\r\n env:\r\n WOODPECKER_SERVER: \"woodpecker.woodpecker.svc.cluster.local:9000\"\r\n WOODPECKER_BACKEND: \"kubernetes\"\r\n WOODPECKER_BACKEND_K8S_STORAGE_CLASS: \"\u003Credacted (same as above)>\"\r\n# WOODPECKER_BACKEND_DOCKER_VOLUMES: \"/etc/docker/certs.d:/etc/docker/certs.d:ro\"\r\n\r\n extraSecretNamesForEnvFrom:\r\n - woodpecker-secret\r\n\r\n extraVolumes:\r\n - name: registry-ca-crt\r\n configMap:\r\n name: registry-ca-crt\r\n\r\n# dind:\r\n# enabled: true\r\n# extraVolumeMounts:\r\n# - name: registry-ca-crt\r\n# mountPath: \"/etc/docker/certs.d/myregistry:5001\"\r\n\r\n fullnameOverride: \"woodpecker-agent\"\r\n```\n```\n\n\n### Additional context\n\n_No response_\n\n### Validations\n\n- [X] Read the [Contributing Guidelines](https://github.com/woodpecker-ci/woodpecker/blob/master/CONTRIBUTING.md).\n- [X] Read the [docs](https://woodpecker-ci.org/docs/intro).\n- [X] Check that there isn't [already an issue](https://github.com/woodpecker-ci/woodpecker/issues) that reports the same bug to avoid creating a duplicate.\n- [X] Checked that the bug isn't fixed in the `next` version already [https://woodpecker-ci.org/faq#which-version-of-woodpecker-should-i-use]\n- [X] Check that this is a concrete bug. For Q&A join our [Discord Chat Server](https://discord.gg/fcMQqSMXJy) or the [Matrix room](https://matrix.to/#/#woodpecker:matrix.org).",[3102],{"name":3020,"color":3021},1918,"x509: certificate signed by unknown authority (cannot provide ca.crt)","2023-07-22T10:17:32Z","https://github.com/woodpecker-ci/woodpecker/issues/1918",0.7423105,{"description":3109,"labels":3110,"number":3112,"owner":3026,"repository":3027,"state":3094,"title":3113,"updated_at":3114,"url":3115,"score":3116},"### Component\n\nagent\n\n### Describe the bug\n\nWhen running an agent with the Kubernetes backend, not setting any labels in the agent config (`WOODPECKER_BACKEN_K8S_POD_LABELS`) causes an assignment to a non initialized string map.\r\n\r\n\r\n```text\r\npanic: assignment to entry in nil map\r\n\r\ngoroutine 90 [running]:\r\ngithub.com/woodpecker-ci/woodpecker/pipeline/backend/kubernetes.Pod({0xc000054051, 0xa}, 0xc00016ef00, 0x0, 0x0)\r\n\t/src/pipeline/backend/kubernetes/pod.go:91 +0x81b\r\ngithub.com/woodpecker-ci/woodpecker/pipeline/backend/kubernetes.(*kube).Exec(0xc0002819e0, {0x1cf52c0, 0xc0003ea440}, 0x2900450?)\r\n\t/src/pipeline/backend/kubernetes/kubernetes.go:165 +0x65\r\ngithub.com/woodpecker-ci/woodpecker/pipeline.(*Runtime).exec(0xc00046c540, 0xc00016ef00)\r\n\t/src/pipeline/pipeline.go:218 +0x42\r\ngithub.com/woodpecker-ci/woodpecker/pipeline.(*Runtime).execAll.func1()\r\n\t/src/pipeline/pipeline.go:186 +0x1ce\r\ngolang.org/x/sync/errgroup.(*Group).Go.func1()\r\n\t/src/vendor/golang.org/x/sync/errgroup/errgroup.go:75 +0x64\r\ncreated by golang.org/x/sync/errgroup.(*Group).Go\r\n\t/src/vendor/golang.org/x/sync/errgroup/errgroup.go:72 +0xa5\r\n{\"level\":\"info\",\"time\":\"2023-01-04T01:00:43Z\",\"message\":\"Starting Woodpecker agent with version 'next-f1e9c841' and backend 'kubernetes' running up to 1 pipelines in parallel\"}\r\n```\n\n### System Info\n\n```shell\nServer: next-f1e9c841\r\nAgent next-f1e9c841 and backend kubernetes\n```\n\n\n### Additional context\n\nThe Issue was likely introduced in #1510 since it completely changed the label handling (before that there was just a single statement initializing and setting the step label).\r\n\r\nThe line causing the panic is the assignment of the `labels[\"step\"] = podName(step)`, if there is no extra label provided in the agents config, `labels` is uninitialized at this point (nil), due to the `yaml.Unmarshal` not writing anything into the `&config.PodLabels` which causes the error.\r\n\r\nUnmarshalling\r\n\r\nhttps://github.com/woodpecker-ci/woodpecker/blob/f1e9c8416dafb6c236694765d9f7dde9620592da/pipeline/backend/kubernetes/kubernetes.go#L61\r\n\r\nAssignment where the assignment to nil happens\r\n\r\nhttps://github.com/woodpecker-ci/woodpecker/blob/f1e9c8416dafb6c236694765d9f7dde9620592da/pipeline/backend/kubernetes/pod.go#L91\r\n\r\nJust noting this down here before I have time to fix it...\r\n\r\nI'd tend to fix this by doing a nil check after the unmarshaling of the podLabels in kubernetes.go#61 (before the return), any opinions on that or should it rather be fixed by checking for nil in within the function in pod.go, before reaching pod.go#91 ?\r\n\r\n\r\n\n\n### Validations\n\n- [X] Read the [Contributing Guidelines](https://github.com/woodpecker-ci/woodpecker/blob/master/CONTRIBUTING.md).\n- [X] Read the [docs](https://woodpecker-ci.org/docs/intro).\n- [X] Check that there isn't [already an issue](https://github.com/woodpecker-ci/woodpecker/issues) that reports the same bug to avoid creating a duplicate.\n- [X] Check that this is a concrete bug. For Q&A join our [Discord Chat Server](https://discord.gg/fcMQqSMXJy) or the [Matrix room](https://matrix.to/#/#woodpecker:matrix.org).",[3111],{"name":3020,"color":3021},1527,"Backend Kubernetes Panic when no WOODPECKER_BACKEN_K8S_POD_LABELS are provided","2023-01-04T17:51:24Z","https://github.com/woodpecker-ci/woodpecker/issues/1527",0.744342,{"description":3118,"labels":3119,"number":3124,"owner":3026,"repository":3027,"state":3094,"title":3125,"updated_at":3126,"url":3127,"score":3128},"### Clear and concise description of the problem\r\n\r\n`AppArmorBetaContainerAnnotationKeyPrefix` got deprecated (renamed to `DeprecatedAppArmorBetaContainerAnnotationKeyPrefix`):\r\n```go\r\n\t// DeprecatedAppArmorBetaContainerAnnotationKeyPrefix is the prefix to an annotation key specifying a container's apparmor profile.\r\n\t// Deprecated: use a pod or container security context `appArmorProfile` field instead.\r\n\tDeprecatedAppArmorBetaContainerAnnotationKeyPrefix = \"container.apparmor.security.beta.kubernetes.io/\"\r\n```\r\n\r\n\r\n### Suggested solution\r\n\r\nChange the code accordingly.\r\nCompatibility is a question to discuss.\r\n\r\n### Alternative\r\n\r\n_No response_\r\n\r\n### Additional context\r\n\r\n37ea9069582653c0d787d857693c0cbf56c6ded0\r\n\r\n`appArmorProfile` is supported since [Kubernetes v1.30](https://kubernetes.io/docs/tutorials/security/apparmor/#securing-a-pod).\r\n\r\n### Validations\r\n\r\n- [X] Checked that the feature isn't part of the `next` version already [https://woodpecker-ci.org/faq#which-version-of-woodpecker-should-i-use]\r\n- [X] Read the [docs](https://woodpecker-ci.org/docs/intro).\r\n- [X] Check that there isn't already an [issue](https://github.com/woodpecker-ci/woodpecker/issues) that request the same feature to avoid creating a duplicate.",[3120,3123],{"name":3121,"color":3122},"refactor","4f8cc9",{"name":3023,"color":3024},3755,"K8s: moving towards appArmorProfile","2024-08-06T17:05:06Z","https://github.com/woodpecker-ci/woodpecker/issues/3755",0.7554129,["Reactive",3130],{},["Set"],["ShallowReactive",3133],{"$fTRc1wZytZ_XrK4EfJfei_Sz-An4H4Yy6syhVxH_PVJc":-1,"$fQ8TGtPbWiLjLRxR2njCBPvJwThrP9Ra8WuTI9uLcJ7I":-1},"/woodpecker-ci/woodpecker/1367"]