mirror of
https://github.com/vhaudiquet/homeprod.git
synced 2026-10-15 19:56:15 +00:00
kosmosandvhaudiquet
1623b2ea7d
The prior postUpgradeTasks command 'sops -d ... && sops -e' was wrong: Renovate has no preUpgradeTasks hook, and postUpgradeTasks runs AFTER Renovate rewrites the file. These values.yaml are SOPS documents whose sops.mac authenticates the whole file, so editing a plaintext image.tag invalidates the MAC and 'sops -d' then fails (data-integrity error). The claimed decrypt-after-bump therefore could never work. boot.sh now decrypts every values.yaml in the checkout BEFORE Renovate extracts/edits them, committing the decrypted tree locally (never pushed, so no plaintext secrets enter remote git). postUpgradeTasks is reduced to 'sops -e -i' only (the file is already plaintext when Renovate edits it). Validated: kustomize build passes for the whole kubernetes/ tree.
78 lines
2.7 KiB
YAML
78 lines
2.7 KiB
YAML
# Self-hosted Renovate runner.
|
|
#
|
|
# Runs the managed `renovatebot/renovate` image on a schedule against the
|
|
# `vhaudiquet/homeprod` repo (see config.json). Because our `values.yaml` are
|
|
# SOPS-encrypted and must be decrypted *before* Renovate edits them (and
|
|
# re-encrypted before the PR commit), Renovate cannot run on the Mend-hosted
|
|
# app — it must be self-hosted with the sops command allow-listed
|
|
# (see config.json -> allowedPostUpgradeCommands) and the SOPS PGP private key
|
|
# loaded (renovate-gpg secret below). boot.sh performs the pre-extraction
|
|
# decrypt; postUpgradeTasks performs the re-encrypt.
|
|
apiVersion: batch/v1
|
|
kind: CronJob
|
|
metadata:
|
|
name: renovate
|
|
namespace: renovate
|
|
spec:
|
|
# Run every hour; Renovate's own "schedule": ["every weekend"] (config.json)
|
|
# gates when PRs are actually created.
|
|
schedule: "42 * * * *"
|
|
concurrencyPolicy: Forbid
|
|
successfulJobsHistoryLimit: 2
|
|
failedJobsHistoryLimit: 4
|
|
jobTemplate:
|
|
spec:
|
|
backoffLimit: 0
|
|
template:
|
|
spec:
|
|
restartPolicy: Never
|
|
tolerations:
|
|
- key: CriticalAddonsOnly
|
|
operator: Exists
|
|
containers:
|
|
- name: renovate
|
|
image: renovatebot/renovate:latest
|
|
envFrom:
|
|
- secretRef:
|
|
name: renovate-secrets
|
|
env:
|
|
- name: RENOVATE_CONFIG_FILE
|
|
value: /etc/renovate/config.json
|
|
- name: LOG_LEVEL
|
|
value: info
|
|
# boot.sh decrypts values.yaml BEFORE Renovate extracts/edits them
|
|
# (Renovate has no preUpgradeTasks hook; see boot.sh for why),
|
|
# then runs renovate. postUpgradeTasks only re-encrypts.
|
|
command:
|
|
- /bin/sh
|
|
- /etc/renovate/boot.sh
|
|
volumeMounts:
|
|
- name: config
|
|
mountPath: /etc/renovate/config.json
|
|
subPath: config.json
|
|
readOnly: true
|
|
- name: boot
|
|
mountPath: /etc/renovate/boot.sh
|
|
subPath: boot.sh
|
|
readOnly: true
|
|
- name: gpg
|
|
mountPath: /etc/renovate/gpg
|
|
readOnly: true
|
|
resources:
|
|
requests:
|
|
cpu: 100m
|
|
memory: 384Mi
|
|
limits:
|
|
cpu: 1000m
|
|
memory: 1Gi
|
|
volumes:
|
|
- name: config
|
|
configMap:
|
|
name: renovate-config
|
|
- name: boot
|
|
configMap:
|
|
name: renovate-config
|
|
- name: gpg
|
|
secret:
|
|
name: renovate-gpg
|