apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
namespace: renovate
resources:
  - namespace.yaml
  - cronjob.yaml
# Scalar Renovate env vars (token, SOPS key fingerprint, ...). Stored as a
# dotenv file and SOPS-encrypted by the .pre-commit hook (matches .env rule).
configMapGenerator:
  - name: renovate-config
    files:
      - config.json=config.json
      - boot.sh=boot.sh
secretGenerator:
  - name: renovate-secrets
    envs:
      - renovate.env
  # SOPS PGP private key needed by the renovate runner to decrypt values.yaml
  # at boot and to re-encrypt them during postUpgradeTasks. Mounted into the
  # pod and imported into the container gpg keyring at startup.
  - name: renovate-gpg
    files:
      - git-renovate-gpg.key