diff --git a/kubernetes/code/renovate/boot.sh b/kubernetes/code/renovate/boot.sh new file mode 100644 index 0000000..a38e4fd --- /dev/null +++ b/kubernetes/code/renovate/boot.sh @@ -0,0 +1,69 @@ +#!/bin/sh +# +# Renovate runner bootstrap / entrypoint. +# +# Renovate has NO preUpgradeTasks hook (schema only exposes postUpgradeTasks), +# and postUpgradeTasks runs AFTER Renovate has already edited the dependency +# files. That matters because these `values.yaml` files are SOPS documents: +# the `sops:` metadata block carries a `mac:` that authenticates the whole +# file, so ANY edit (even to a plaintext `image.tag`) invalidates it and makes +# `sops -d` fail with a MAC/data-integrity error. You cannot decrypt the file +# *after* Renovate has touched it. +# +# So we decrypt BEFORE Renovate extracts any dependency info: +# 1. clone the repo into the exact checkout path Renovate will reuse +# 2. `sops -d -i` every values.yaml in place (plaintext, no `sops:` block) +# 3. local-commit the decrypted working tree onto the local base branch +# (NOT pushed -> encrypted blobs stay in remote git, no plaintext secrets +# ever leave the runner) +# 4. run Renovate. It now reads plaintext tags and edits plaintext files. +# postUpgradeTasks only needs `sops -e -i` (encrypt) to rebuild a valid +# SOPS document containing the bumped tag. +# +# The local commit is important: step 3 makes `git checkout ` restore the +# decrypted content from the LOCAL branch rather than the encrypted remote blob, +# so Renovate's branch operations don't silently resurrect the encrypted file +# and re-introduce the MAC-mismatch problem. + +set -eu + +# SOPS PGP private key must be available to decrypt AND to re-encrypt. +if [ -f /etc/renovate/gpg/git-renovate-gpg.key ]; then + gpg --batch --import /etc/renovate/gpg/git-renovate-gpg.key || true +fi + +# Renovate stores repos under $RENOVATE_BASE_DIR/repos///. +BASE_DIR="${RENOVATE_BASE_DIR:-/tmp/renovate}" +REPO_DIR="${BASE_DIR}/repos/github/vhaudiquet/homeprod" +REPO_URL="https://x-access-token:${RENOVATE_TOKEN}@github.com/vhaudiquet/homeprod.git" +DEFAULT_BRANCH="${DEFAULT_BRANCH:-main}" + +mkdir -p "$(dirname "$REPO_DIR")" + +# 1. Ensure a fresh, valid checkout of the base branch exists. +if [ -d "${REPO_DIR}/.git" ]; then + git -C "$REPO_DIR" fetch --all --prune + git -C "$REPO_DIR" -c advice.detachedHead=false checkout "$DEFAULT_BRANCH" \ + && git -C "$REPO_DIR" reset --hard "origin/${DEFAULT_BRANCH}" +else + git clone --no-tags --single-branch --branch "$DEFAULT_BRANCH" "$REPO_URL" "$REPO_DIR" + git -C "$REPO_DIR" config user.name renovate + git -C "$REPO_DIR" config user.email renovate@localhost +fi + +# 2. Decrypt every values.yaml still carrying SOPS metadata (in-place). +# Skips files that are already plaintext (no `sops:` block) so the bootstrap +# is idempotent across re-runs. +find "$REPO_DIR" -name 'values.yaml' -type f \ + -exec grep -l -m1 '^sops:' {} + 2>/dev/null \ + | xargs -r -n1 sops -d -i + +# 3. Local commit (never pushed) so Renovate's checkout of the base branch +# keeps working on decrypted files. +git -C "$REPO_DIR" add -A +if ! git -C "$REPO_DIR" diff --cached --quiet; then + git -C "$REPO_DIR" commit -m "chore(renovate): decrypt values for update (local bootstrap)" --quiet +fi + +# 4. Run Renovate itself. +exec renovate "$@" diff --git a/kubernetes/code/renovate/cronjob.yaml b/kubernetes/code/renovate/cronjob.yaml index 3c038b7..7f4a570 100644 --- a/kubernetes/code/renovate/cronjob.yaml +++ b/kubernetes/code/renovate/cronjob.yaml @@ -1,11 +1,13 @@ # Self-hosted Renovate runner. # # Runs the managed `renovatebot/renovate` image on a schedule against the -# `vhaudiquet/homeprod` repo (see config.json). Because we need to run SOPS -# during postUpgradeTasks (re-encrypting values.yaml), Renovate cannot run on -# the Mend-hosted app — it must be self-hosted with the sops command allow-listed +# `vhaudiquet/homeprod` repo (see config.json). Because our `values.yaml` are +# SOPS-encrypted and must be decrypted *before* Renovate edits them (and +# re-encrypted before the PR commit), Renovate cannot run on the Mend-hosted +# app — it must be self-hosted with the sops command allow-listed # (see config.json -> allowedPostUpgradeCommands) and the SOPS PGP private key -# loaded (renovate-gpg secret below). +# loaded (renovate-gpg secret below). boot.sh performs the pre-extraction +# decrypt; postUpgradeTasks performs the re-encrypt. apiVersion: batch/v1 kind: CronJob metadata: @@ -38,20 +40,21 @@ spec: value: /etc/renovate/config.json - name: LOG_LEVEL value: info + # boot.sh decrypts values.yaml BEFORE Renovate extracts/edits them + # (Renovate has no preUpgradeTasks hook; see boot.sh for why), + # then runs renovate. postUpgradeTasks only re-encrypts. command: - /bin/sh - - -ec - - | - set -eu - # Import the SOPS PGP private key so rebuild/enable SOPS - # re-encryption in postUpgradeTasks works. - gpg --batch --import /etc/renovate/gpg/git-renovate-gpg.key || true - exec renovate + - /etc/renovate/boot.sh volumeMounts: - name: config mountPath: /etc/renovate/config.json subPath: config.json readOnly: true + - name: boot + mountPath: /etc/renovate/boot.sh + subPath: boot.sh + readOnly: true - name: gpg mountPath: /etc/renovate/gpg readOnly: true @@ -66,6 +69,9 @@ spec: - name: config configMap: name: renovate-config + - name: boot + configMap: + name: renovate-config - name: gpg secret: name: renovate-gpg diff --git a/kubernetes/code/renovate/kustomization.yaml b/kubernetes/code/renovate/kustomization.yaml index 5c91c96..be03358 100644 --- a/kubernetes/code/renovate/kustomization.yaml +++ b/kubernetes/code/renovate/kustomization.yaml @@ -10,13 +10,14 @@ configMapGenerator: - name: renovate-config files: - config.json=config.json + - boot.sh=boot.sh secretGenerator: - name: renovate-secrets envs: - renovate.env - # SOPS PGP private key needed by the renovate runner to re-encrypt - # values.yaml during postUpgradeTasks. Mounted into the pod and imported - # into the container gpg keyring at startup. + # SOPS PGP private key needed by the renovate runner to decrypt values.yaml + # at boot and to re-encrypt them during postUpgradeTasks. Mounted into the + # pod and imported into the container gpg keyring at startup. - name: renovate-gpg files: - git-renovate-gpg.key diff --git a/renovate.json b/renovate.json index 6a8682b..6043ac2 100644 --- a/renovate.json +++ b/renovate.json @@ -10,14 +10,14 @@ "helmv3" ], "postUpgradeTasks": { - "description": "SOPS round-trip on encrypted values.yaml. Renovate has no preUpgrade hook, so the decrypt must happen here: after the tag bump but before commit, decrypt the file, then re-encrypt. Encrypting an already-encrypted file would double-encrypt the existing ENC secret values and corrupt them.", + "description": "Re-encrypt values.yaml after Renovate bumps an image tag. These files are decrypted to plaintext by the runner's boot.sh BEFORE Renovate extracts/edits them (Renovate has no preUpgradeTasks hook, and a post-edit decrypt would fail: editing a SOPS file invalidates its mac). So by the time this task runs, the file is plaintext and `sops -e -i` safely rebuilds a valid SOPS document carrying the bumped tag. branch mode re-encrypts each changed file once, after all deps on the branch are updated.", "commands": [ - "sops -d {{packageFile}} > {{packageFile}}.plain && mv {{packageFile}}.plain {{packageFile}} && sops -e -i {{packageFile}}" + "sops -e -i {{packageFile}}" ], "fileFilters": [ "**/values.yaml" ], - "executionMode": "update" + "executionMode": "branch" }, "packageRules": [ {