# Self-hosted Renovate runner.
#
# Runs the managed `renovatebot/renovate` image on a schedule against the
# `vhaudiquet/homeprod` repo (see config.json). Because our `values.yaml` are
# SOPS-encrypted and must be decrypted *before* Renovate edits them (and
# re-encrypted before the PR commit), Renovate cannot run on the Mend-hosted
# app — it must be self-hosted with the sops command allow-listed
# (see config.json -> allowedPostUpgradeCommands) and the SOPS PGP private key
# loaded (renovate-gpg secret below). boot.sh performs the pre-extraction
# decrypt; postUpgradeTasks performs the re-encrypt.
apiVersion: batch/v1
kind: CronJob
metadata:
  name: renovate
  namespace: renovate
spec:
  # Run every hour; Renovate's own "schedule": ["every weekend"] (config.json)
  # gates when PRs are actually created.
  schedule: "42 * * * *"
  concurrencyPolicy: Forbid
  successfulJobsHistoryLimit: 2
  failedJobsHistoryLimit: 4
  jobTemplate:
    spec:
      backoffLimit: 0
      template:
        spec:
          restartPolicy: Never
          tolerations:
            - key: CriticalAddonsOnly
              operator: Exists
          containers:
            - name: renovate
              image: renovatebot/renovate:latest
              envFrom:
                - secretRef:
                    name: renovate-secrets
              env:
                - name: RENOVATE_CONFIG_FILE
                  value: /etc/renovate/config.json
                - name: LOG_LEVEL
                  value: info
              # boot.sh decrypts values.yaml BEFORE Renovate extracts/edits them
              # (Renovate has no preUpgradeTasks hook; see boot.sh for why),
              # then runs renovate. postUpgradeTasks only re-encrypts.
              command:
                - /bin/sh
                - /etc/renovate/boot.sh
              volumeMounts:
                - name: config
                  mountPath: /etc/renovate/config.json
                  subPath: config.json
                  readOnly: true
                - name: boot
                  mountPath: /etc/renovate/boot.sh
                  subPath: boot.sh
                  readOnly: true
                - name: gpg
                  mountPath: /etc/renovate/gpg
                  readOnly: true
              resources:
                requests:
                  cpu: 100m
                  memory: 384Mi
                limits:
                  cpu: 1000m
                  memory: 1Gi
          volumes:
            - name: config
              configMap:
                name: renovate-config
            - name: boot
              configMap:
                name: renovate-config
            - name: gpg
              secret:
                name: renovate-gpg