mirror of
https://github.com/vhaudiquet/homeprod.git
synced 2026-09-22 00:43:32 +00:00
kosmosandvhaudiquet
1623b2ea7d
The prior postUpgradeTasks command 'sops -d ... && sops -e' was wrong: Renovate has no preUpgradeTasks hook, and postUpgradeTasks runs AFTER Renovate rewrites the file. These values.yaml are SOPS documents whose sops.mac authenticates the whole file, so editing a plaintext image.tag invalidates the MAC and 'sops -d' then fails (data-integrity error). The claimed decrypt-after-bump therefore could never work. boot.sh now decrypts every values.yaml in the checkout BEFORE Renovate extracts/edits them, committing the decrypted tree locally (never pushed, so no plaintext secrets enter remote git). postUpgradeTasks is reduced to 'sops -e -i' only (the file is already plaintext when Renovate edits it). Validated: kustomize build passes for the whole kubernetes/ tree.
24 lines
754 B
YAML
24 lines
754 B
YAML
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
kind: Kustomization
|
|
namespace: renovate
|
|
resources:
|
|
- namespace.yaml
|
|
- cronjob.yaml
|
|
# Scalar Renovate env vars (token, SOPS key fingerprint, ...). Stored as a
|
|
# dotenv file and SOPS-encrypted by the .pre-commit hook (matches .env rule).
|
|
configMapGenerator:
|
|
- name: renovate-config
|
|
files:
|
|
- config.json=config.json
|
|
- boot.sh=boot.sh
|
|
secretGenerator:
|
|
- name: renovate-secrets
|
|
envs:
|
|
- renovate.env
|
|
# SOPS PGP private key needed by the renovate runner to decrypt values.yaml
|
|
# at boot and to re-encrypt them during postUpgradeTasks. Mounted into the
|
|
# pod and imported into the container gpg keyring at startup.
|
|
- name: renovate-gpg
|
|
files:
|
|
- git-renovate-gpg.key
|