- Pin gateway image to immutable tag 2026.9.3: the stale node-cached
'latest' (old build, state schema v1) crash-looped against the PVC's
DB already migrated to schema v15/16.
- Add fix-data-owner init container: the operator mounts the PVC root
at /home/openclaw/.openclaw with fsGroup only, leaving the mount root
owned by root; OpenClaw >= 2026.9 fchmods its config dir on write and
fails with EPERM (paperclipinc/openclaw-operator#607).
- Ran one-time 'openclaw doctor --fix --non-interactive' against the
PVC to complete the 2.0 workspace-state migration.
Per review feedback: remove the self-hosted Renovate deployment
(kubernetes/code/renovate/* + root kustomization wiring) from this PR and
defer it to a follow-up. Keep the renovate.json config to merge now.
Also drop the postUpgradeTasks SOPS re-encrypt block: it depended on the
runner's boot.sh decrypt flow, and the hosted Mend app cannot run 'sops'
(allowedPostUpgradeCommands). SOPS handling returns with the deployment.
The prior postUpgradeTasks command 'sops -d ... && sops -e' was wrong:
Renovate has no preUpgradeTasks hook, and postUpgradeTasks runs AFTER
Renovate rewrites the file. These values.yaml are SOPS documents whose
sops.mac authenticates the whole file, so editing a plaintext image.tag
invalidates the MAC and 'sops -d' then fails (data-integrity error). The
claimed decrypt-after-bump therefore could never work.
boot.sh now decrypts every values.yaml in the checkout BEFORE Renovate
extracts/edits them, committing the decrypted tree locally (never pushed,
so no plaintext secrets enter remote git). postUpgradeTasks is reduced to
'sops -e -i' only (the file is already plaintext when Renovate edits it).
Validated: kustomize build passes for the whole kubernetes/ tree.
Address review feedback on SOPS handling for encrypted values.yaml.
- renovate.json: Renovate has NO preUpgradeTasks option (verified against
the renovate-schema). Decrypt must therefore happen inside postUpgradeTasks
(which run after the tag bump, before the commit): decrypt the values.yaml,
then re-encrypt. Encrypting an already-encrypted file would double-encrypt
the existing ENC secret values. Only **/values.yaml is re-encrypted; the
docker-compose and Chart.yaml files are not SOPS-encrypted here.
- kubernetes/code/renovate: self-hosted Renovate runner as a Flux CronJob
running the renovatebot/renovate image, with sops allowed as a
postUpgradeTask command and the SOPS PGP key loaded to re-encrypt
values.yaml. Secrets come from SOPS-encrypted dotenv/env file sources.
- Wire code/renovate into the root kubernetes kustomization.
Allow the openclaw pod to reach the Radicale CalDAV/CardDAV server
(namespace: radicale, port 5232) so Kosmos can read/write Valentin's
calendar via the in-cluster service. Mirrors networkpolicy-mail-egress.yaml.
Workaround for spec.networkPolicy.additionalEgress not being in the CRD
bundled with operator chart 0.39.0 yet (silently pruned).
vhaudiquet
renovate[bot]andvhaudiquet
kosmos-ai-botandvhaudiquet
kosmosandvhaudiquet