mirror of
https://github.com/vhaudiquet/homeprod.git
synced 2026-09-21 16:36:05 +00:00
kosmosandvhaudiquet
5bf07a2fff
Address review feedback on SOPS handling for encrypted values.yaml. - renovate.json: Renovate has NO preUpgradeTasks option (verified against the renovate-schema). Decrypt must therefore happen inside postUpgradeTasks (which run after the tag bump, before the commit): decrypt the values.yaml, then re-encrypt. Encrypting an already-encrypted file would double-encrypt the existing ENC secret values. Only **/values.yaml is re-encrypted; the docker-compose and Chart.yaml files are not SOPS-encrypted here. - kubernetes/code/renovate: self-hosted Renovate runner as a Flux CronJob running the renovatebot/renovate image, with sops allowed as a postUpgradeTask command and the SOPS PGP key loaded to re-encrypt values.yaml. Secrets come from SOPS-encrypted dotenv/env file sources. - Wire code/renovate into the root kubernetes kustomization.