Address review feedback on SOPS handling for encrypted values.yaml.
- renovate.json: Renovate has NO preUpgradeTasks option (verified against
the renovate-schema). Decrypt must therefore happen inside postUpgradeTasks
(which run after the tag bump, before the commit): decrypt the values.yaml,
then re-encrypt. Encrypting an already-encrypted file would double-encrypt
the existing ENC secret values. Only **/values.yaml is re-encrypted; the
docker-compose and Chart.yaml files are not SOPS-encrypted here.
- kubernetes/code/renovate: self-hosted Renovate runner as a Flux CronJob
running the renovatebot/renovate image, with sops allowed as a
postUpgradeTask command and the SOPS PGP key loaded to re-encrypt
values.yaml. Secrets come from SOPS-encrypted dotenv/env file sources.
- Wire code/renovate into the root kubernetes kustomization.
Drop the generate-renovate.sh generator and explicit fileMatch lists.
Renovate auto-discovers docker-compose, values.yaml and Chart.yaml via
the docker-compose, helm-values and helmv3 managers. Use helmv3 (not
helm-requirements) for Chart.yaml dependencies (Helm v3).
Allow the openclaw pod to reach the Radicale CalDAV/CardDAV server
(namespace: radicale, port 5232) so Kosmos can read/write Valentin's
calendar via the in-cluster service. Mirrors networkpolicy-mail-egress.yaml.
Workaround for spec.networkPolicy.additionalEgress not being in the CRD
bundled with operator chart 0.39.0 yet (silently pruned).
kosmosandvhaudiquet