Drone CI stack for Kubernetes

All notable changes to this project are documented here.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

v4.1.0 - 2026-08-21

Changed

NOTE: Drone server and runner deployments might be upgraded

• Drone server Helm chart (from 0.6.4 to 0.6.5) and application (from 2.12.0 to 2.28.2) versions
• Drone runner Helm chart (from 0.6.1 to 0.7.0) and application (from 1.8.3 to 1.8.5) versions

Fixed

• drone_server.scm_settings input validation rules for the SCM types that require the SCM server

v4.0.0 - 2026-04-02

NOTE: Make sure that other modules in the project support the new (major) Helm and Kubernetes provider versions, see the Upgrade Notes section

Added

• option to define the ingress class name with the ingress_class variable (nginx by default)
• options to define ingress annotations for the ingresses of the Drone server and runner with the ingress_annotations parameter for the drone_server and drone_runner variables

Changed

• minimal Helm Terraform provider version to 3.1
• minimal Kubernetes Terraform provider version to 3.0
• minimal Terraform required version to 1.9 due to using cross-object referencing for input variable validations
• drone_rpc_secret and runner_ui_pwd resource types from random_string to random_password, which leads to change of the drone_rpc_secret and runner_dashboard_credentials output values

v3.3.0 - 2025-07-28

(Last version compatible with Helm and Kubernetes Terraform providers version 2.0)

Added

• functionality to deploy a flexible set of Kubernetes Network Policies

v3.2.0 - 2025-06-23

Added

• option to create machine admin user with Terraform-generated token with the drone_admin_is_machine_account argument for the drone_server variable
• validation for the drone_admin_user argument of the drone_server variable
• output with Drone admin user credentials

v3.1.0 - 2025-05-21

Added

• outputs with Drone server public and private hosts (drone_server_public_host, drone_server_private_host)

v3.0.0 - 2023-12-11

BREAKING CHANGE: Kubernetes Drone runner has been deprecated and now its deployment is managed by relevant Docker type which isn't compatible with the previous version

NOTE: After the module upgrade to v3.0, all pipelines managed by Drone runner must be updated to use the Docker type, see the Upgrade Notes section

Added

• option to specify a custom ServiceAccount for the Drone runner instead of using the one that is managed by the Drone runner Helm chart

Changed

• migrated Helm chart repo of Drone runner from drone-runner-kube to drone-runner-docker
• updated Helm values of Drone runner
• drone_rpc_secret output is defined as a string instead of a list with one element if Drone server deployment is enabled

v2.1.0 - 2023-05-03

Added

• Drone runner variable to allow additional K8s API groups, resources, and set of permissions to Drone runner K8s Role

v2.0.2 - 2023-03-21

NOTE: Drone server deployment might be upgraded

Changed

• updated default version of Drone server Helm chart from 0.2.5 to 0.6.4
• updated Helm values templates in order to prettify the rendering of values within the processing

Fixed

• updating of Drone server Helm release in case if its settings in the inputs were changed

v2.0.1 - 2023-03-02

Fixed

• processing of node selectors for Helm releases

v2.0.0 - 2023-02-09

BREAKING CHANGE: now all kubernetes provider resources use versioned resources which aren't compatible with previous version

NOTE: After module upgrade to v2.0 all kubernetes provider resources and other resources that depend on them will be recreated, or they can be reimported to TF state manually, see the Upgrade Notes section

Changed

• use versioned Kubernetes provider resources instead of standard ones in order to satisfy requirements of future updates of providers
• code refactoring

v1.0.0 - 2022-10-25

Added

• ability to create additional namespace for Drone components or use already existing one;
• variety of Drone components deployment (deploy both - server and runner locally, or deploy a single component (server or runner) for connecting to a remote another one)
• ability to assign DRONE_RUNNER_LABELS to Drone runners
• allow Drone runner to access specific namespaces (or all) in the cluster it runs in

From v1.x to v2.x

Now all Kubernetes provider resources use versioned resources. According to Kubernetes provider's suggestions the simplest, non-destructive way to do this is to remove the old resource from state and import this resource as a version one, like so:

 bash# If Kubernetes namespace was managed by the module, it must be re-imported
terraform state rm module.drone_ci.kubernetes_namespace.namespace[0]
terraform import module.drone_ci.kubernetes_namespace_v1.namespace[0] drone
# If there were namespaces that Drone runner needs to access, their settings must be re-imported
terraform state rm module.drone_ci.kubernetes_role.drone_runner["backend"] module.drone_ci.kubernetes_role_binding.drone_runner["backend"]
terraform import module.drone_ci.kubernetes_role_v1.drone_runner["backend"] drone-runner-backend
terraform import module.drone_ci.kubernetes_role_binding_v1.drone_runner["backend"] drone-runner-backend

From v2.x to v3.x

Now Drone runner uses deployment of Docker type. All the pipelines processed by a managed Drone runner must be updated to use docker type:

```yml

kind: pipeline
type: docker
```

To pull the Docker images from private registries, a Drone secret with credentials to the private container registry must be created and referenced in pipelines:

```yml
steps:
- name: build
image: registry.internal.company.com/golang:1.12
commands:
- go build
- go test

image_pull_secrets:
- dockerconfig
```

For K8s management (e.g. by means of kubectl or/and helm tools) K8s configuration files must be provided in the pipeline steps. For example, a step can be added in the pipeline that will retrieve and save a K8s configuration file in the default Drone workspace directory (which content will be available between all of the steps within the running pipeline) and reference this saved file in kubectl or/and helm commands of the next steps in the same pipeline.

WARNING: Do not roll out Drone runner on the node managed in the subnet with 172.17.0.0/16 address pool, because it will overlap with the default docker0 network.

drone_rpc_secret output is defined as a string instead of a list with one element if Drone server deployment is enabled, and its references should be updated accordingly:

 hclmodule.drone_ci.drone_rpc_secret[0]  ==>  module.drone_ci.drone_rpc_secret

From v3.x to v4.x

Module from v4.0 has several management changes that require attention:

• changed Kubernetes and Helm Terraform providers versions, which aren't compatible with older versions. After the module version is upgraded, re-init the module to upgrade the providers versions. Upgrade the provider versions at the project level:

```hcl
terraform {
required_providers {
helm = {
source = "hashicorp/helm"
version = "~> 3.1"
}

 text  kubernetes = {
    source  = "hashicorp/kubernetes"
    version = "~> 3.0"
  }
}

}
```

Upgrade project dependencies:

bash terraform init --upgrade

If set, rewrite node selectors and custom values passed to the module components as nested maps following the below example:

```hcl
module "drone_ci" {
...
# From v3.x format
drone_server = {
custom_values = {
"ingress.enabled" = "true"
}

 scdoc  node_selector = {
    "cloud\\.google\\.com/gke-nodepool" = "maintenance"
  }
}

# To v4.0 format
drone_server = {
  custom_values = {
    ingress = {
      enabled = true
    }
  }

  node_selector = {
    "cloud.google.com/gke-nodepool" = "maintenance"
  }
}

}
```

Apply the changes to make sure the state of the resources is up-to-date with the new provider versions:

 bashterraform apply