forked from vhaudiquet/homeprod
kosmosandvhaudiquet
5bf07a2fff
Address review feedback on SOPS handling for encrypted values.yaml. - renovate.json: Renovate has NO preUpgradeTasks option (verified against the renovate-schema). Decrypt must therefore happen inside postUpgradeTasks (which run after the tag bump, before the commit): decrypt the values.yaml, then re-encrypt. Encrypting an already-encrypted file would double-encrypt the existing ENC secret values. Only **/values.yaml is re-encrypted; the docker-compose and Chart.yaml files are not SOPS-encrypted here. - kubernetes/code/renovate: self-hosted Renovate runner as a Flux CronJob running the renovatebot/renovate image, with sops allowed as a postUpgradeTask command and the SOPS PGP key loaded to re-encrypt values.yaml. Secrets come from SOPS-encrypted dotenv/env file sources. - Wire code/renovate into the root kubernetes kustomization.
19 lines
779 B
Bash
19 lines
779 B
Bash
# Self-hosted Renovate runtime secrets.
|
|
#
|
|
# FILL THESE IN. This file is SOPS-encrypted on commit by the .pre-commit hook
|
|
# (it matches the `.env` rule in .sops.yaml), and decrypted by kustomize-controller
|
|
# via flux-sops before the Secret is generated.
|
|
|
|
# Fine-grained/personal access token with read+writes:content and read:issues,
|
|
# read:pull_requests, and contents read/write on vhaudiquet/homeprod so Renovate
|
|
# can open and push PR branches.
|
|
RENOVATE_TOKEN=
|
|
|
|
# Optional: GitHub token used for public API rate-limit boosting (can be the
|
|
# same as RENOVATE_TOKEN, or a dedicated one).
|
|
GITHUB_COM_TOKEN=
|
|
|
|
# SOPS master key fingerprint used to (re-)encrypt values.yaml in this repo.
|
|
# Matches the `pgp:` entry in .sops.yaml.
|
|
SOPS_PGP_FP=DC6910268E657FF70BA7EC289974494E76938DDC
|