mirror of
https://github.com/vhaudiquet/homeprod.git
synced 2026-10-15 19:56:15 +00:00
kosmosandvhaudiquet
5bf07a2fff
Address review feedback on SOPS handling for encrypted values.yaml. - renovate.json: Renovate has NO preUpgradeTasks option (verified against the renovate-schema). Decrypt must therefore happen inside postUpgradeTasks (which run after the tag bump, before the commit): decrypt the values.yaml, then re-encrypt. Encrypting an already-encrypted file would double-encrypt the existing ENC secret values. Only **/values.yaml is re-encrypted; the docker-compose and Chart.yaml files are not SOPS-encrypted here. - kubernetes/code/renovate: self-hosted Renovate runner as a Flux CronJob running the renovatebot/renovate image, with sops allowed as a postUpgradeTask command and the SOPS PGP key loaded to re-encrypt values.yaml. Secrets come from SOPS-encrypted dotenv/env file sources. - Wire code/renovate into the root kubernetes kustomization.
23 lines
702 B
YAML
23 lines
702 B
YAML
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
kind: Kustomization
|
|
namespace: renovate
|
|
resources:
|
|
- namespace.yaml
|
|
- cronjob.yaml
|
|
# Scalar Renovate env vars (token, SOPS key fingerprint, ...). Stored as a
|
|
# dotenv file and SOPS-encrypted by the .pre-commit hook (matches .env rule).
|
|
configMapGenerator:
|
|
- name: renovate-config
|
|
files:
|
|
- config.json=config.json
|
|
secretGenerator:
|
|
- name: renovate-secrets
|
|
envs:
|
|
- renovate.env
|
|
# SOPS PGP private key needed by the renovate runner to re-encrypt
|
|
# values.yaml during postUpgradeTasks. Mounted into the pod and imported
|
|
# into the container gpg keyring at startup.
|
|
- name: renovate-gpg
|
|
files:
|
|
- git-renovate-gpg.key
|