kubernetes/apps/woodpecker/agent.yaml

@@ -44,10 +44,13 @@ spec:
             # Workspace volume for each build. ceph-block is RWO, but a step's
             # clone + subsequent steps share the workspace PVC and the k8s backend
             # can schedule them on different nodes -> an RWO volume then fails to
-            # mount on the second node. ceph-filesystem (CephFS, RWX) lets the
-            # workspace follow the pipeline across nodes.
+            # mount on the second node. CephFS (RWX) lets the workspace follow
+            # the pipeline across nodes. The -ephemeral variant (reclaim Delete,
+            # rook-ceph-cluster/storageclass.yaml) is REQUIRED here: workspaces
+            # are throwaway, and the Retain class leaked one Released PV per
+            # finished pipeline (issue #262 follow-up).
             - name: WOODPECKER_BACKEND_K8S_STORAGE_CLASS
-              value: ceph-filesystem
+              value: ceph-filesystem-ephemeral
             - name: WOODPECKER_BACKEND_K8S_STORAGE_RWX
               value: "true"
             # MUST be a JSON object literal — the backend json.Unmarshal's this

kubernetes/infrastructure/rook-ceph-cluster/storageclass.yaml

@@ -81,3 +81,26 @@ parameters:
   csi.storage.k8s.io/node-stage-secret-namespace: rook-ceph
 reclaimPolicy: Retain
 allowVolumeExpansion: true
+---
+# Same CephFS class but reclaimPolicy Delete — for THROWAWAY volumes only
+# (Woodpecker CI workspace PVCs). The Retain default exists so production
+# PVC deletions are undoable; CI workspaces are the opposite case, and with
+# Retain every finished pipeline leaked a Released PV pinning a CephFS
+# subvolume (191 of them by 2026-07-16, issue #262 follow-up).
+apiVersion: storage.k8s.io/v1
+kind: StorageClass
+metadata:
+  name: ceph-filesystem-ephemeral
+provisioner: rook-ceph.cephfs.csi.ceph.com
+parameters:
+  clusterID: rook-ceph
+  fsName: cephfs
+  pool: cephfs-data0
+  csi.storage.k8s.io/provisioner-secret-name: rook-csi-cephfs-provisioner
+  csi.storage.k8s.io/provisioner-secret-namespace: rook-ceph
+  csi.storage.k8s.io/controller-expand-secret-name: rook-csi-cephfs-provisioner
+  csi.storage.k8s.io/controller-expand-secret-namespace: rook-ceph
+  csi.storage.k8s.io/node-stage-secret-name: rook-csi-cephfs-node
+  csi.storage.k8s.io/node-stage-secret-namespace: rook-ceph
+reclaimPolicy: Delete
+allowVolumeExpansion: true