renovate: deploy renovate on kube

2026-09-22 00:43:32 +00:00 · 2026-08-26 21:35:02 +02:00
parent 45f8f84cbc
commit a80b45618c
51 changed files with 1074 additions and 864 deletions
@@ -0,0 +1,14 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: renovate
+resources:
+  - namespace.yaml
+  - repository.yaml
+  - release.yaml
+  - token-secret.yaml
+secretGenerator:
+  - name: renovate-values
+    files:
+      - values.yaml=values.yaml
+configurations:
+  - kustomizeconfig.yaml
@@ -0,0 +1,6 @@
+nameReference:
+  - kind: Secret
+    version: v1
+    fieldSpecs:
+      - path: spec/valuesFrom/name
+        kind: HelmRelease
@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: renovate
@@ -0,0 +1,19 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: renovate
+  namespace: renovate
+spec:
+  interval: 1m
+  chart:
+    spec:
+      sourceRef:
+        kind: HelmRepository
+        name: renovate
+        namespace: renovate
+      chart: renovate
+      version: "46.260.4"
+      interval: 1m
+  valuesFrom:
+    - kind: Secret
+      name: renovate-values
@@ -0,0 +1,8 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: renovate
+  namespace: renovate
+spec:
+  interval: 1h
+  url: https://docs.renovatebot.com/helm-charts
@@ -0,0 +1,43 @@
+# GitHub Personal Access Token used by the Renovate CronJob.
+# The chart injects this Secret's keys as container env vars (envFrom), and
+# Renovate picks up RENOVATE_TOKEN automatically.
+#
+# Required scopes (fine-grained PAT, restricted to vhaudiquet/homeprod):
+#   - Contents: Read & write   (push update branches)
+#   - Pull requests: Read & write
+#   - Workflows: Read & write  (repo has .github/, lets Renovate manage
+#                               action-related files if configured later)
+apiVersion: v1
+kind: Secret
+metadata:
+    name: renovate-token
+    namespace: renovate
+type: Opaque
+stringData:
+    RENOVATE_TOKEN: ENC[AES256_GCM,data:XgCD6ppqguo6MMv0OScXUkqhn07Mo31F8o4yf9Hd51wHjpmh/DHBSREqBzYpETrB4vDjec9AVyylOTz5qEITFdme+K8qg4L6Ti/JPIm5WOPNsXD84k3ZFIr6PWvQ,iv:ovQhFt2XlyHYzadYlQnQQ/X/NFV+9CeacZ40B1WYjqw=,tag:NTWOBN0ceJ7evKGq+y+cFg==,type:str]
+sops:
+    lastmodified: "2026-08-26T19:31:53Z"
+    mac: ENC[AES256_GCM,data:1EsEQ1JmB0pTgoA062k48hKAa4IUNKm55E/9bbmHPRcI5CUC7IBC2npT2yn0+6eQ7gTSqdrbqZw+xu0LAF5IrEjIIscKE7yZizkFAIy5VuCdZdAOBlvLtc1GXg7PE6ACXn8wHDcWBcAoq12HEAtpdXS1dNhdZBFxkB27RD7UvYw=,iv:hPeTFZlrqXyVNuy3D00VeLqecKDEKKGe/AhuFwSxPYs=,tag:O6+OYfJU3QeL58f5/tUQkg==,type:str]
+    pgp:
+        - created_at: "2026-08-26T19:31:53Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA7uy4qQr71wiARAAvkrhQ3QLbfF4xTCjmLnY4BzudBMrx4j1+zjG7S8MZ/oL
+            Vx4ji8gAxRIvv6DZ/eSwybeTijtY4ROUQRAm+2Ut5r2yKVGZiokTUE3js/SgQ4Nx
+            uSMcEdn5GOilgM/c30GXsWzCo3yiGWWCNISwxOLvdRC2FEw0OYxTRSEvtBnck22q
+            FExVE6fvH/ks7nak3ry9Bo4OEVZZrLmr8MR/RL/l6Z8AyOLCp7yss+a0OvTb+NRq
+            PVQXmoLlRYqEdbkW8lbyt32oJ451ukMH3l6yscC0ZxHIC6XvKUwUa9uhcUPLZq97
+            o73fmYqCSKmfLc8CMTDX97d9yuApOepZZtVaJGxLhxd/pNIZNwbojoo6pCKh8bdY
+            2CdSf/FA+EqjG1B6CtzHCE35FgiYuDxFsOM7WbPROvT8n7QYVnZGI/QoFawWAFsw
+            heFi9sDGBcqM+bZDo7NTV0Nd25Q/+GfCHpK1BAug4n3K61OuJhJfHw1kadbH81y0
+            vWN9AAQTYfu5FjqMjSbyASbTYNX28a776ojYrR6HGgD2A5PyC1vBAR+VZwSernfm
+            N+wJ8YAK/2hPKVReEhYFcJiSm/MuNW9QD49/gbj7Y/NFs5NEJlV33cAEo6hyduR+
+            Z+Aw2M9xOsz+qFop86oRGSXNCZh/TG/G5/7rjS2zNG0vQAsgQ+xVXmDJPsmZnPnS
+            XgFuPLMkIN+DFl3PaX9LwkqgROXA3KGG4jZsZ4qzQ0+fZOCAvoU7FNXKnyQ/i2qv
+            NPSRW2WLDAAbqwjj3jNxdd3JFRbDq6XQ+V175fYN8sTFuOYLq59d8YD7Z8e9+aU=
+            =xVRA
+            -----END PGP MESSAGE-----
+          fp: DC6910268E657FF70BA7EC289974494E76938DDC
+    encrypted_regex: ^(data|stringData|.*key|.*crt)$
+    version: 3.10.2
@@ -0,0 +1,70 @@
+# Official Renovate chart (https://github.com/renovatebot/helm-charts).
+# Runs Renovate as a CronJob against github.com/vhaudiquet/homeprod.
+#
+# The GitHub token is NOT stored here: it lives in token-secret.yaml and is
+# injected as env (top-level existingSecret -> envFrom), picked up by Renovate
+# as RENOVATE_TOKEN.
+cronjob:
+    # Aligns with the "every weekend" schedule in the repo's renovate.json:
+    # one run every Saturday morning is enough to open the weekly PRs.
+    schedule: 0 6 * * 6
+    timeZone: Europe/Paris
+    concurrencyPolicy: Forbid
+    successfulJobsHistoryLimit: 1
+    failedJobsHistoryLimit: 2
+# Top-level chart key: wires the `renovate-token` Secret's keys as container
+# env vars via envFrom.
+existingSecret: ENC[AES256_GCM,data:tt9OJ41wHayCWgQYd+Y=,iv:jBqe+K1hL36ViFntV4cU3qh9jdnG6W8e4LiE99rIFIA=,tag:Kj8/qKd689iIatQgUc+9iA==,type:str]
+renovate:
+    # Self-hosted config (https://docs.renovatebot.com/self-hosted-configuration).
+    # Repo-level update policy lives in renovate.json at the repo root; this only
+    # tells the bot WHERE to run and WHO to authenticate as.
+    config: |
+        {
+          "platform": "github",
+          "repositories": ["vhaudiquet/homeprod"],
+          "gitAuthor": "renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>",
+          "onboarding": false,
+          "persistRepoData": true
+        }
+    persistence:
+        cache:
+            # Persist the repo cache + SQLite between runs: much faster clones and
+            # fewer GitHub API calls on a weekly schedule.
+            enabled: true
+            storageClass: longhorn
+            storageSize: 1Gi
+resources:
+    requests:
+        cpu: 50m
+        memory: 256Mi
+    limits:
+        cpu: "1"
+        memory: 1Gi
+sops:
+    lastmodified: "2026-08-26T19:31:53Z"
+    mac: ENC[AES256_GCM,data:fA2nukiGOWK5UVQRbBagOLdqSBjYYG2VysxXfQ3TuRtFYhN8bd16j5xIfy2aDrlLEVw19uhInggQMu2vJg7xT6V6Z9w5YsHwcSQWSGCMjTk764/ChT3QGA0nhVG2ktgsZgaiU/MrCAPN/XQP3dG6Y25vkcptFcXnn7Ig5D+V2eQ=,iv:3fKfVaDJ7RjjAI0n4I+6na9pKLB07yGgjvRXjh7I3Iw=,tag:cyclZ/i2rfKeAof15J4ufA==,type:str]
+    pgp:
+        - created_at: "2026-08-26T19:31:53Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA7uy4qQr71wiARAAi9efDDL8A1RFxx50RBFjLi3G2OG8XQfo/UF3O7gd65vH
+            tu+3b9KtiRvWurOVqapAxUwapiiwx4Gsem5F1Q9FoX+5HfQ3APQ91kxfGjQTjx00
+            2lt+pl4JyeKj0+ilGMP5xaUyOvZGNB33v4ls14Uljzg3tqQQPGUvYMJ6f5svXXOo
+            ugagStCSx9jh0j++Y9gCFZXYSn3C1IblGeUxkh7fUJQjveqp8R5Ofntdg7sbV5Au
+            Xeah95zdQxdJ/zb6GW7t0dWY5KEYi4Tg1gNybvMIKDdWZ8NND7kaFOSx5Bg8aGJa
+            +6nh21MHs7oNmzpxLXNa9rTk1ncE2HcLcTIXl+NHf10dPcR6R32w8Bc5e1UtBKI9
+            mUeHgH2zphG4Xihcchbeeb6RAxBvl2EWLglxB/HKKw8ouC3EmlOj63QS7o8ES8CZ
+            z+/uq4uOP65Q9k0xa9YHl4nGVXlOYqxFkiB71UYIqwUxyw/Th0IEZhBrd2GFf2wl
+            CUj9DDDejWBvGyIwp1MIRLhQkMrL4KczHLAdMEC/OcvylZHxESOpMEIq+CUXi0wr
+            GyjnwLS3F1ZPB0+Xbpy8OfTKAT1jI6Z65G6138p6c8xJsh+lBwBd4QFTJ0VfR+fd
+            /edCwMKalySDK0Li9OIphj1or90l/ZURdlZpIrgnYrYeBg7HibuN2E0u0cMur/DS
+            XgExhwYtGznQThvIySwqAa2YMLm5tz5PJ1mUGkJ2AUaJuQX9SfhFYJSCGjpv8Fbf
+            04FCKZ7B8eG9j9ae0Wfn07SeN9xSZEMuCtE0KLjAR0v5ACAF5Lb6Ee5tc+5K2sk=
+            =zZdk
+            -----END PGP MESSAGE-----
+          fp: DC6910268E657FF70BA7EC289974494E76938DDC
+    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$
+    mac_only_encrypted: true
+    version: 3.10.2