apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
namespace: renovate
resources:
  - namespace.yaml
  - cronjob.yaml
# Scalar Renovate env vars (token, SOPS key fingerprint, ...). Stored as a
# dotenv file and SOPS-encrypted by the .pre-commit hook (matches .env rule).
configMapGenerator:
  - name: renovate-config
    files:
      - config.json=config.json
secretGenerator:
  - name: renovate-secrets
    envs:
      - renovate.env
  # SOPS PGP private key needed by the renovate runner to re-encrypt
  # values.yaml during postUpgradeTasks. Mounted into the pod and imported
  # into the container gpg keyring at startup.
  - name: renovate-gpg
    files:
      - git-renovate-gpg.key