github/woodpecker
1
0
Fork 0
mirror of https://github.com/woodpecker-ci/woodpecker.git synced 2026-09-05 20:07:25 +00:00
Code Issues Packages Projects Releases Wiki Activity

Kubernetes: Support allowPrivilegeEscalation and capabilities backend_options (#6307)

Browse Source
This commit is contained in:
Alex Caston
2026-04-28 17:17:00 +02:00
committed by GitHub
parent 2c801366ee
commit 43dcdc19a1
4 changed files with 138 additions and 31 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/docs/30-administration/10-configuration/11-backends/20-kubernetes.md
+20
View File
@@ -359,6 +359,26 @@ backend_options:
The feature requires Kubernetes v1.30 or above.
:::
You can set `allowPrivilegeEscalation` to `false` to prevent a container from gaining more privileges than its parent process.
```yaml
backend_options:
kubernetes:
securityContext:
allowPrivilegeEscalation: false
```
You can also drop [Linux capabilities](https://man7.org/linux/man-pages/man7/capabilities.7.html) from a container. Adding capabilities is not allowed.
```yaml
backend_options:
kubernetes:
securityContext:
capabilities:
drop:
- ALL
```
### Annotations and labels
You can specify arbitrary [annotations](https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/) and [labels](https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/) to be set on the Pod definition for a given workflow step using the following configuration: