\n\nExample in https://woodpecker-ci.org/docs/usage/plugins/overview:\n\n\u003Cimg width=\"200\" alt=\"Image\" src=\"https://github.com/user-attachments/assets/045c8698-9f1e-47d9-a9cb-272107be6e26\" />\n\n# Doc update request\n\n**Please update the doc and remove any mention to Kaniko, or at least, mention that Kaniko is deprecated ?**\n\nAt last, not part of this issue, but if you promote [woodpeckerci/plugin-docker-buildx](https://hub.docker.com/r/woodpeckerci/plugin-docker-buildx), please better explain how to use it with each of the backends (I worked hard to make it work with kubernetes, and it still does not work with my standalone docker instance)",[],5358,"Kaniko is deprecated. Please update the documentation","2025-07-25T12:04:41Z","https://github.com/woodpecker-ci/woodpecker/issues/5358",0.7640726,{"description":3040,"labels":3041,"number":3045,"owner":3024,"repository":3025,"state":3026,"title":3046,"updated_at":3047,"url":3048,"score":3049},"### Clear and concise description of the problem\n\nIn a resource constrained environment, jobs using the kubernetes backend should not starve live workloads of ressources. For this purpose Kubernets supports [PriorityClasses](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/priority-class-v1/) which I want to be able to configure for my CI jobs.\n\n### Suggested solution\n\nThe kubernetes backend should support a new configuration option `BACKEND_K8S_PRIORITY_CLASS` (similar to `BACKEND_K8S_STORAGE_CLASS`) which should set the [`spec.priorityClassName`](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling) option of created pods.\n\n### Alternative\n\n_No response_\n\n### Additional context\n\n_No response_\n\n### Validations\n\n- [x] Checked that the feature isn't part of the `next` version already [https://woodpecker-ci.org/versions]\n- [x] Read the [docs](https://woodpecker-ci.org/docs/intro).\n- [x] Check that there isn't already an [issue](https://github.com/woodpecker-ci/woodpecker/issues) that request the same feature to avoid creating a duplicate.",[3042],{"name":3043,"color":3044},"feature","180DBE",5229,"Kubernets backend should allow configuring job priority classes","2025-05-31T09:54:46Z","https://github.com/woodpecker-ci/woodpecker/issues/5229",0.7647769,{"description":3051,"labels":3052,"number":3054,"owner":3024,"repository":3025,"state":3026,"title":3055,"updated_at":3056,"url":3057,"score":3058},"### Clear and concise description of the problem\n\nHi, thanks for this project! The Kubernetes integration appears to be much better thought out than most other CI systems we've used.\n\nUnfortunately, as far as we can tell, cloning a repo using the Woodpecker-provided `netrc` credentials isn't possible without root privileges, short of marking the project as \"Trusted:Security\", which is probably worse overall, from a security perspective:\n\n* The default clone step runs as the root user, so the runner namespace must be privileged. On security-conscious Kubernetes distributions like Talos, namespaces are not privileged by default, so the runner namespace needs the `pod-security.kubernetes.io/enforce: privileged` label on these distributions. In our clusters, we prefer to add this label only when the app absolutely requires elevated privileges; e.g., because it needs to use host networking.\n* Because the default clone step runs as the root user, the otherwise very handy `WOODPECKER_BACKEND_K8S_SECCTX_NONROOT` option is incompatible with it. The default clone step pod will always fail to start if this option is set.\n* As far as I can tell, the only reason that Woodpecker runs the default clone step as the root user is to set the filesystem permissions on the workspace directory. However, unless I'm missing something, that could easily be addressed by using the `fsGroupChangePolicy` pod security context setting, without any need for root privileges.\n\nInitially, #4151 had support for `fsGroupChangePolicy` (e.g., https://github.com/woodpecker-ci/woodpecker/pull/4151/commits/3c7e071a56713c4176e713c8572a94fc21b0b7bc), but that appears to have been removed at some stage before the merge, though it's not clear to me why.\n\n\n\n### Suggested solution\n\nUnless there's some other reason why the default clone step needs to run as root, adding support for `fsGroupChangePolicy` in the Kubernetes `backend_options` and de-privileging the default clone step would be a major security posture improvement for the Kubernetes backend.\n\n### Alternative\n\n### Run the clone step manually\n\nBecause the `woodpeckerci/plugin-git` plugin is trusted, Woodpecker provides it with the `netrc` creds when run as a plugin. Therefore, we tried running a manual clone step, first like this:\n\n```\nskip_clone: true\n\nsteps:\n - name: clone\n image: quay.io/woodpeckerci/plugin-git:2.6.5\n backend_options:\n kubernetes:\n securityContext:\n runAsUser: 405 # `guest` user in Alpine\n runAsGroup: 100 # `users` group in Alpine\n fsGroup: 100\n privileged: false\n runAsNonRoot: true\n seccompProfile:\n type: RuntimeDefault\n```\n\nHowever, that failed because the default `HOME` is `/app`, and the pod couldn't access `/app/.netrc`.\n\nWe then tried this:\n\n```\nskip_clone: true\n\nsteps:\n - name: clone\n image: quay.io/woodpeckerci/plugin-git:2.6.5\n settings:\n home: /tmp\n backend_options:\n kubernetes:\n securityContext:\n runAsUser: 405\n runAsGroup: 100\n fsGroup: 100\n privileged: false\n runAsNonRoot: true\n seccompProfile:\n type: RuntimeDefault\n```\n\nThen the pod was able to read `/tmp/.netrc`, but that failed due to permissions on the mounted workspace, which leads us to the need for `fsGroupChangePolicy`:\n\n```\n+ git init --object-format sha1 -b main\n/woodpecker/src/forgejo.hackworth-corp.com/hackworth/hops/.git: Permission denied\nexit status 1\n```\n\n### User namespaces\n\nSince v1.30, Kubernetes supports user namespaces: https://kubernetes.io/docs/concepts/workloads/pods/user-namespaces/\n\nThe feature is currently in beta. When it's enabled, and `pod.spec.hostUsers` is `false`, Kubernetes creates a separate UID/GID namespace, so that, e.g., UID `0` in the pod is not the same as UID `0` outside the pod; i.e., it has no privileges outside the pod. If a Woodpecker Kubernetes backend option to disable `hostUsers` were available, we'd be more comfortable with the default clone step running as UID `0`. (For starters, based on our testing of the feature with other apps, it's not necessary to privilege the namespace when running containers as UID `0` and `hostUsers` disabled.) However, we'd still feel much better if the default clone step ran as non-root.\n\nIrrespective of this particular issue, user namespaces would be a useful feature for other CI workloads that need to run as root, but don't require actual system-level privileges.\n\n\n\n### Additional context\n\n_No response_\n\n### Validations\n\n- [x] Checked that the feature isn't part of the `next` version already [https://woodpecker-ci.org/versions]\n- [x] Read the [docs](https://woodpecker-ci.org/docs/intro).\n- [x] Check that there isn't already an [issue](https://github.com/woodpecker-ci/woodpecker/issues) that request the same feature to avoid creating a duplicate.",[3053],{"name":3043,"color":3044},5346,"Kubernetes: de-privileging the clone step","2025-07-22T14:28:02Z","https://github.com/woodpecker-ci/woodpecker/issues/5346",0.774989,{"description":3060,"labels":3061,"number":3063,"owner":3024,"repository":3025,"state":3064,"title":3065,"updated_at":3066,"url":3067,"score":3068},"### Component\n\nserver, agent\n\n### Describe the bug\n\nWhen variable `WOODPECKER_BACKEND_K8S_POD_ANNOTATIONS` is filled up with some annotations it doesn't pass to the pod anymore.\r\n\r\nI think this code is related to the bug. \r\nhttps://github.com/woodpecker-ci/woodpecker/blob/main/pipeline/backend/kubernetes/kubernetes.go#L166C4-L166C18\n\n### System Info\n\n```shell\n{\"source\":\"https://github.com/woodpecker-ci/woodpecker\",\"version\":\"2.2.2\"}\n```\n\n\n### Additional context\n\n_No response_\n\n### Validations\n\n- [X] Read the [docs](https://woodpecker-ci.org/docs/intro).\n- [X] Check that there isn't [already an issue](https://github.com/woodpecker-ci/woodpecker/issues) that reports the same bug to avoid creating a duplicate.\n- [X] Checked that the bug isn't fixed in the `next` version already [https://woodpecker-ci.org/faq#which-version-of-woodpecker-should-i-use]",[3062],{"name":3021,"color":3022},3254,"closed","Pod Annotations is missing on 2.2.2","2024-01-22T13:24:07Z","https://github.com/woodpecker-ci/woodpecker/issues/3254",0.74203354,{"description":3070,"labels":3071,"number":3076,"owner":3024,"repository":3025,"state":3064,"title":3077,"updated_at":3078,"url":3079,"score":3080},"### Component\n\nagent\n\n### Describe the bug\n\nWoodpecker generates a prefix for kubernetes resources like `0-2156149869907855750`. This can be used as prefix for a pvc name but it's an invalid prefix for services because \"The name of a Service object must be a valid RFC1035 label name\" ([source](https://kubernetes.io/docs/concepts/services-networking/service/#defining-a-service)).\r\n\r\nThe ci config:\r\n\r\n```\r\nservices:\r\n docker:\r\n image: docker:22.06-rc-dind\r\n\r\npipeline:\r\n build:\r\n image: docker:22.06-rc-dind\r\n commands:\r\n - printenv | sort\r\n```\r\n\r\nThe error:\r\n\r\n```\r\ndefault/woodpecker-woodpecker-agent-f485dddcf-bhlqb[woodpecker-agent]: {\r\n \"level\": \"error\",\r\n \"error\": \"rpc error: code = Unknown desc = Proc finished with exitcode 1, Service \\\"0-2891002623454858384-services-0\\\" is invalid: [metadata.name: Invalid value: \\\"0-2891002623454858384-services-0\\\": a DNS-1035 label must consist of lower case alphanumeric characters or '-', start with an alphabetic character, and end with an alphanumeric character (e.g. 'my-name', or 'abc-123', regex used for validation is '[a-z]([-a-z0-9]*[a-z0-9])?'), spec.ports: Required value]\",\r\n \"time\": \"2022-10-04T21:50:55Z\",\r\n \"message\": \"grpc error: wait(): code: Unknown: rpc error: code = Unknown desc = Proc finished with exitcode 1, Service \\\"0-2891002623454858384-services-0\\\" is invalid: [metadata.name: Invalid value: \\\"0-2891002623454858384-services-0\\\": a DNS-1035 label must consist of lower case alphanumeric characters or '-', start with an alphabetic character, and end with an alphanumeric character (e.g. 'my-name', or 'abc-123', regex used for validation is '[a-z]([-a-z0-9]*[a-z0-9])?'), spec.ports: Required value]\"\r\n}\r\n```\n\n### System Info\n\n```shell\n{\r\n \"source\": \"https://github.com/woodpecker-ci/woodpecker\",\r\n \"version\": \"next-612eee82\"\r\n}\n```\n\n\n### Additional context\n\n_No response_\n\n### Validations\n\n- [X] Read the [Contributing Guidelines](https://github.com/woodpecker-ci/woodpecker/blob/master/CONTRIBUTING.md).\n- [X] Read the [docs](https://woodpecker-ci.org/docs/intro).\n- [X] Check that there isn't [already an issue](https://github.com/woodpecker-ci/woodpecker/issues) that reports the same bug to avoid creating a duplicate.\n- [X] Check that this is a concrete bug. For Q&A join our [Discord Chat Server](https://discord.gg/fcMQqSMXJy) or the [Matrix room](https://matrix.to/#/#woodpecker:matrix.org).",[3072,3073],{"name":3021,"color":3022},{"name":3074,"color":3075},"skip-changelog","8B9BE0",1232,"Invalid service name on Kubernetes ","2022-10-11T16:18:57Z","https://github.com/woodpecker-ci/woodpecker/issues/1232",0.7495962,{"description":3082,"labels":3083,"number":3088,"owner":3024,"repository":3025,"state":3064,"title":3089,"updated_at":3090,"url":3091,"score":3092},"### Clear and concise description of the problem\n\nWhile testing #1032 I stumbled upon the Service Account not having the required permissions to use the Kubernetes backend.\r\n\r\nThis problem applies to any next, helm chart based setup with Kubernetes backend on a Kubernetes Cluster with active RBAC (which from a security perspective should be pretty much everywhere, all major enterprise K8s solutions rke2, okd, OpenShift, cloud providers, etc. have it active by default, many, more developer focused k8s-variants micro-k8s, minikube, etc., have options to enable it).\n\n### Suggested solution\n\nAdd a role and roleBinding in the chart to allow agents with the Kubernetes backend to spawn the needed pods, collect logs, etc.\r\n\r\nIt might be an idea to take the Kubernetes backend config into its own values section, where all the Kubernetes backend settings can be added/configured, as well as deciding whether to deploy the service account with RBAC.\n\n### Alternative\n\nWrite an additional section into the Kubernetes / Helm deployment docs outlining that a user should create the RBAC if RBAC is in use.\r\nAlso document which API-groups resources and verbs are required (which in effect is almost as much work as directly integrating it into the chart).\n\n### Additional context\n\nWas unsure whether this is considered a bug or feature request...\n\n### Validations\n\n- [X] Read the [Contributing Guidelines](https://github.com/woodpecker-ci/woodpecker/blob/master/CONTRIBUTING.md).\n- [X] Read the [docs](https://woodpecker-ci.org/docs/intro).\n- [X] Check that there isn't already an [issue](https://github.com/woodpecker-ci/woodpecker/issues) that request the same feature to avoid creating a duplicate.",[3084,3085],{"name":3043,"color":3044},{"name":3086,"color":3087},"backend/kubernetes","bfdadc",1367,"Helm chart add RBAC / config section for Kubernetes backend","2022-10-30T21:48:00Z","https://github.com/woodpecker-ci/woodpecker/issues/1367",0.75273335,{"labels":3094,"number":3096,"owner":3024,"repository":3025,"state":3064,"title":3097,"updated_at":3098,"url":3099,"score":3100},[3095],{"name":3021,"color":3022},4430,"Need both environment and settings for plugin appleboy/dron-ssh, but this is deprecated","2024-11-22T20:07:08Z","https://github.com/woodpecker-ci/woodpecker/issues/4430",0.75274336,{"description":3102,"labels":3103,"number":3108,"owner":3024,"repository":3025,"state":3064,"title":3109,"updated_at":3110,"url":3111,"score":3112},"### Clear and concise description of the problem\n\nhttps://woodpecker-ci.org/docs/next/administration/backends/kubernetes#volumes\r\n\r\nMake reference to \r\n```\r\n settings:\r\n mount:\r\n - \"woodpecker-cache\"\r\n```\r\n\r\nWhich is no longer supported when used with things like `command:`\r\n\r\n\n\n### Suggested solution\n\nRemoving that part, and including a sample PVC like \r\n\r\n```\r\napiVersion: v1\r\nkind: PersistentVolumeClaim\r\nmetadata:\r\n name: woodpecker-cache\r\nspec:\r\n storageClassName: \"longhorn\"\r\n accessModes:\r\n - ReadWriteMany\r\n resources:\r\n requests:\r\n storage: 1Gi\r\n```\r\n\r\nMight go well to enhancing this part of the documentation.\n\n### Alternative\n\nAlternatively, just removing that settings part and providing a link to the kubernetes docs (https://kubernetes.io/docs/concepts/storage/persistent-volumes/) might serve as well.\n\n### Additional context\n\n_No response_\n\n### Validations\n\n- [X] Checked that the feature isn't part of the `next` version already [https://woodpecker-ci.org/faq#which-version-of-woodpecker-should-i-use]\n- [X] Read the [docs](https://woodpecker-ci.org/docs/intro).\n- [X] Check that there isn't already an [issue](https://github.com/woodpecker-ci/woodpecker/issues) that request the same feature to avoid creating a duplicate.",[3104,3107],{"name":3105,"color":3106},"documentation","7D625D",{"name":3086,"color":3087},4369,"Documentation: Kubernetes mounts","2024-11-16T20:46:00Z","https://github.com/woodpecker-ci/woodpecker/issues/4369",0.755171,{"description":3114,"labels":3115,"number":3119,"owner":3024,"repository":3025,"state":3064,"title":3120,"updated_at":3121,"url":3122,"score":3123},"### Component\n\nagent, cli\n\n### Describe the bug\n\nhttps://github.com/docker/go-docker/issues/21\n\n### System Info\n\n```shell\n{\"source\":\"https://github.com/woodpecker-ci/woodpecker\",\"version\":\"dev\"}\n```\n\n\n### Additional context\n\n_No response_\n\n### Validations\n\n- [X] Read the [Contributing Guidelines](https://github.com/woodpecker-ci/woodpecker/blob/master/CONTRIBUTING.md).\n- [X] Read the [docs](https://woodpecker-ci.github.io/docs/intro).\n- [X] Check that there isn't [already an issue](https://github.com/woodpecker-ci/woodpecker/issues) that reports the same bug to avoid creating a duplicate.\n- [X] Check that this is a concrete bug. For Q&A join our [Discord Chat Server](https://discord.gg/fcMQqSMXJy).",[3116],{"name":3117,"color":3118},"dependencies","006b75",325,"go-docker is deprecated","2021-09-26T12:43:15Z","https://github.com/woodpecker-ci/woodpecker/issues/325",0.7577818,["Reactive",3125],{},["Set"],["ShallowReactive",3128],{"$fTRc1wZytZ_XrK4EfJfei_Sz-An4H4Yy6syhVxH_PVJc":-1,"$f-SU3qKgqtq1mockx-GgnxHXXV8UBCDS48fIQjg1bu4g":-1},"/woodpecker-ci/woodpecker/3755"]