github/woodpecker
1
0
Fork 0
mirror of https://github.com/woodpecker-ci/woodpecker.git synced 2025-09-16 06:00:40 +00:00
Code Issues Packages Projects Releases Wiki Activity

Allow admins to specify priviledged plugins by name **and tag** (#4075)

Browse Source 
previous the tags where ignored, now we respect them if set
This commit is contained in:
6543
2024-09-01 21:27:12 +02:00
committed by GitHub
parent 3c8204a0e0
commit 5b208d2c01
3 changed files with 4 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
docs/docs/30-administration/10-server-config.md
View File

@@ -354,6 +354,8 @@ a user can log into Woodpecker, without re-authentication.
Docker images to run in privileged mode. Only change if you are sure what you do! Docker images to run in privileged mode. Only change if you are sure what you do!
You should specify the tag of your images too, as this enforces exact matches.
### WOODPECKER_PLUGINS_TRUSTED_CLONE ### WOODPECKER_PLUGINS_TRUSTED_CLONE
> Defaults are defined in [shared/constant/constant.go](https://github.com/woodpecker-ci/woodpecker/blob/main/shared/constant/constant.go) > Defaults are defined in [shared/constant/constant.go](https://github.com/woodpecker-ci/woodpecker/blob/main/shared/constant/constant.go)

2
docs/docs/91-migrations.md
View File

@@ -5,7 +5,7 @@ Some versions need some changes to the server configuration or the pipeline conf
## `next` ## `next`
- `WOODPECKER_DEFAULT_CLONE_IMAGE` got depricated use `WOODPECKER_DEFAULT_CLONE_PLUGIN` - `WOODPECKER_DEFAULT_CLONE_IMAGE` got depricated use `WOODPECKER_DEFAULT_CLONE_PLUGIN`
- Check trusted-clone-plugins by image name and tag (if tag is set) - Check trusted-clone- and priviledged-plugins by image name and tag (if tag is set)
- Remove `plugins/docker`, `plugins/gcr` and `plugins/ecr` from the default list of privileged plugins ([modify the list via config if needed](./30-administration/10-server-config.md#woodpecker_escalate)). - Remove `plugins/docker`, `plugins/gcr` and `plugins/ecr` from the default list of privileged plugins ([modify the list via config if needed](./30-administration/10-server-config.md#woodpecker_escalate)).
- Secret filters for plugins now check against tag if specified - Secret filters for plugins now check against tag if specified
- Removed `WOODPECKER_DEV_OAUTH_HOST` and `WOODPECKER_DEV_GITEA_OAUTH_URL` use `WOODPECKER_EXPERT_FORGE_OAUTH_HOST` - Removed `WOODPECKER_DEV_OAUTH_HOST` and `WOODPECKER_DEV_GITEA_OAUTH_URL` use `WOODPECKER_EXPERT_FORGE_OAUTH_HOST`

2
pipeline/frontend/yaml/compiler/convert.go
View File

@@ -138,7 +138,7 @@ func (c *Compiler) createProcess(container *yaml_types.Container, stepType backe
environment[requested] = secretValue environment[requested] = secretValue
} }
if utils.MatchImage(container.Image, c.escalated...) && container.IsPlugin() { if utils.MatchImageDynamic(container.Image, c.escalated...) && container.IsPlugin() {
privileged = true privileged = true
} }