ci: add woodpecker Kyverno proxy CA policy with NO_PROXY for gRPC

pipelines/runmefirst.sh

@@ -115,9 +115,10 @@ echo ""
 # -------------------------------------------------------
 # 5. Apply Woodpecker agent RBAC
 # -------------------------------------------------------
-echo "--- Step 5: Applying Woodpecker agent RBAC ---"
+echo "--- Step 5: Applying Woodpecker agent RBAC and Kyverno policy ---"
 kubectl apply -f woodpecker/agent-rbac.yaml
-echo "  ✓ Agent RBAC applied"
+kubectl apply -f woodpecker/kyverno-proxy-ca.yaml
+echo "  ✓ Agent RBAC and Kyverno proxy CA policy applied"
 echo ""
 
 # -------------------------------------------------------

pipelines/woodpecker/kyverno-proxy-ca.yaml

@@ -0,0 +1,43 @@
+apiVersion: kyverno.io/v1
+kind: ClusterPolicy
+metadata:
+  name: woodpecker-proxy-ca
+  annotations:
+    policies.kyverno.io/title: "Woodpecker Proxy CA Injection"
+    policies.kyverno.io/category: "Networking"
+    policies.kyverno.io/subject: "Pod"
+spec:
+  rules:
+    - name: inject-ca-cert
+      match:
+        any:
+          - resources:
+              kinds:
+                - Pod
+              namespaces:
+                - woodpecker
+      mutate:
+        patchStrategicMerge:
+          spec:
+            containers:
+              - (name): "*"
+                env:
+                  - name: HTTP_PROXY
+                    value: "http://192.168.42.1:3128"
+                  - name: HTTPS_PROXY
+                    value: "http://192.168.42.1:3128"
+                  - name: NO_PROXY
+                    value: "10.0.0.0/8,192.168.0.0/16,127.0.0.1,localhost,.svc,.cluster.local,woodpecker-server"
+                  - name: no_proxy
+                    value: "10.0.0.0/8,192.168.0.0/16,127.0.0.1,localhost,.svc,.cluster.local,woodpecker-server"
+                  - name: SSL_CERT_FILE
+                    value: "/etc/ssl/certs/proxy-ca.crt"
+                volumeMounts:
+                  - name: proxy-ca
+                    mountPath: /etc/ssl/certs/proxy-ca.crt
+                    subPath: ca.crt
+                    readOnly: true
+            volumes:
+              - name: proxy-ca
+                configMap:
+                  name: proxy-ca-cert

pipelines/woodpecker/values.yaml

@@ -48,8 +48,7 @@ agent:
   enabled: true
   replicaCount: 2
 
-  # No proxy CA injection for agents — they only talk to the server internally
+  # CA injection handled by woodpecker-proxy-ca Kyverno policy (matches all pods in namespace)
-  # Pipeline step pods spawned by the agent inherit the node's proxy config
 
   env:
     WOODPECKER_SERVER: "woodpecker-server:9000"