Per review feedback: remove the self-hosted Renovate deployment
(kubernetes/code/renovate/* + root kustomization wiring) from this PR and
defer it to a follow-up. Keep the renovate.json config to merge now.
Also drop the postUpgradeTasks SOPS re-encrypt block: it depended on the
runner's boot.sh decrypt flow, and the hosted Mend app cannot run 'sops'
(allowedPostUpgradeCommands). SOPS handling returns with the deployment.
Address review feedback on SOPS handling for encrypted values.yaml.
- renovate.json: Renovate has NO preUpgradeTasks option (verified against
the renovate-schema). Decrypt must therefore happen inside postUpgradeTasks
(which run after the tag bump, before the commit): decrypt the values.yaml,
then re-encrypt. Encrypting an already-encrypted file would double-encrypt
the existing ENC secret values. Only **/values.yaml is re-encrypted; the
docker-compose and Chart.yaml files are not SOPS-encrypted here.
- kubernetes/code/renovate: self-hosted Renovate runner as a Flux CronJob
running the renovatebot/renovate image, with sops allowed as a
postUpgradeTask command and the SOPS PGP key loaded to re-encrypt
values.yaml. Secrets come from SOPS-encrypted dotenv/env file sources.
- Wire code/renovate into the root kubernetes kustomization.
- Add root kustomization.yaml to explicitly list included paths
- Exclude cert-manager and cert-manager-issuer from root kustomization
- Add Flux Kustomizations in system/flux/ to manage deployment order
- cert-manager Flux Kustomization includes health checks for CRDs
- cert-manager-issuer depends on cert-manager being ready
vhaudiquet
kosmos-ai-botandvhaudiquet
kosmosandvhaudiquet
semerysandvhaudiquet