mirror of
https://github.com/vhaudiquet/homeprod.git
synced 2026-09-22 00:43:32 +00:00
kosmosandvhaudiquet
5bf07a2fff
Address review feedback on SOPS handling for encrypted values.yaml. - renovate.json: Renovate has NO preUpgradeTasks option (verified against the renovate-schema). Decrypt must therefore happen inside postUpgradeTasks (which run after the tag bump, before the commit): decrypt the values.yaml, then re-encrypt. Encrypting an already-encrypted file would double-encrypt the existing ENC secret values. Only **/values.yaml is re-encrypted; the docker-compose and Chart.yaml files are not SOPS-encrypted here. - kubernetes/code/renovate: self-hosted Renovate runner as a Flux CronJob running the renovatebot/renovate image, with sops allowed as a postUpgradeTask command and the SOPS PGP key loaded to re-encrypt values.yaml. Secrets come from SOPS-encrypted dotenv/env file sources. - Wire code/renovate into the root kubernetes kustomization.
72 lines
2.4 KiB
YAML
72 lines
2.4 KiB
YAML
# Self-hosted Renovate runner.
|
|
#
|
|
# Runs the managed `renovatebot/renovate` image on a schedule against the
|
|
# `vhaudiquet/homeprod` repo (see config.json). Because we need to run SOPS
|
|
# during postUpgradeTasks (re-encrypting values.yaml), Renovate cannot run on
|
|
# the Mend-hosted app — it must be self-hosted with the sops command allow-listed
|
|
# (see config.json -> allowedPostUpgradeCommands) and the SOPS PGP private key
|
|
# loaded (renovate-gpg secret below).
|
|
apiVersion: batch/v1
|
|
kind: CronJob
|
|
metadata:
|
|
name: renovate
|
|
namespace: renovate
|
|
spec:
|
|
# Run every hour; Renovate's own "schedule": ["every weekend"] (config.json)
|
|
# gates when PRs are actually created.
|
|
schedule: "42 * * * *"
|
|
concurrencyPolicy: Forbid
|
|
successfulJobsHistoryLimit: 2
|
|
failedJobsHistoryLimit: 4
|
|
jobTemplate:
|
|
spec:
|
|
backoffLimit: 0
|
|
template:
|
|
spec:
|
|
restartPolicy: Never
|
|
tolerations:
|
|
- key: CriticalAddonsOnly
|
|
operator: Exists
|
|
containers:
|
|
- name: renovate
|
|
image: renovatebot/renovate:latest
|
|
envFrom:
|
|
- secretRef:
|
|
name: renovate-secrets
|
|
env:
|
|
- name: RENOVATE_CONFIG_FILE
|
|
value: /etc/renovate/config.json
|
|
- name: LOG_LEVEL
|
|
value: info
|
|
command:
|
|
- /bin/sh
|
|
- -ec
|
|
- |
|
|
set -eu
|
|
# Import the SOPS PGP private key so rebuild/enable SOPS
|
|
# re-encryption in postUpgradeTasks works.
|
|
gpg --batch --import /etc/renovate/gpg/git-renovate-gpg.key || true
|
|
exec renovate
|
|
volumeMounts:
|
|
- name: config
|
|
mountPath: /etc/renovate/config.json
|
|
subPath: config.json
|
|
readOnly: true
|
|
- name: gpg
|
|
mountPath: /etc/renovate/gpg
|
|
readOnly: true
|
|
resources:
|
|
requests:
|
|
cpu: 100m
|
|
memory: 384Mi
|
|
limits:
|
|
cpu: 1000m
|
|
memory: 1Gi
|
|
volumes:
|
|
- name: config
|
|
configMap:
|
|
name: renovate-config
|
|
- name: gpg
|
|
secret:
|
|
name: renovate-gpg
|