add renovate

flux/olympus/apps/kustomization.yaml

@@ -1,4 +1,5 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
+  - services
   - websites

flux/olympus/apps/services/kustomization.yaml

@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - renovate

flux/olympus/apps/services/renovate/external-secret.yaml

@@ -0,0 +1,21 @@
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: renovate
+  namespace: services
+spec:
+  refreshInterval: "5m"
+  secretStoreRef:
+    name: vault
+    kind: ClusterSecretStore
+  target:
+    name: renovate
+  data:
+    - secretKey: RENOVATE_TOKEN
+      remoteRef:
+        key: gitops/renovate
+        property: gitea_token
+    - secretKey: GITHUB_COM_TOKEN
+      remoteRef:
+        key: gitops/renovate
+        property: github_token

flux/olympus/apps/services/renovate/kustomization.yaml

@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - external-secret.yaml
+  - renovate-infrastructure.yaml

flux/olympus/apps/services/renovate/renovate-infrastructure.yaml

@@ -0,0 +1,113 @@
+---
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: renovate-infrastructure
+  namespace: services
+spec:
+  schedule: "@hourly"
+  concurrencyPolicy: Forbid
+  jobTemplate:
+    spec:
+      template:
+        spec:
+          volumes:
+            - name: config-volume
+              configMap:
+                name: renovate-config
+            - name: work-volume
+              emptyDir: {}
+          containers:
+            - name: renovate
+              image: renovate/renovate:32.135
+              volumeMounts:
+                - name: config-volume
+                  mountPath: /opt/renovate/
+                - name: work-volume
+                  mountPath: /tmp/renovate/
+              env:
+                - name: LOG_LEVEL
+                  value: debug
+                - name: RENOVATE_ENDPOINT
+                  value: "https://git.0x76.dev/api/v1/"
+                - name: RENOVATE_PLATFORM
+                  value: gitea
+                - name: RENOVATE_AUTODISCOVER
+                  value: "false"
+                - name: RENOVATE_GIT_AUTHOR
+                  value: "Renovate Bot <renovate@xirion.net>"
+                - name: RENOVATE_CONFIG_FILE
+                  value: "/opt/renovate/config.js"
+                - name: RENOVATE_BASE_DIR
+                  value: "/tmp/renovate"
+              envFrom:
+                - secretRef:
+                    name: renovate
+          restartPolicy: Never
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: renovate-config
+  namespace: gitops
+data:
+  config.js: |-
+    module.exports = {
+      "binarySource": "install",
+      "repositories": ["v/infrastructure"],
+      "flux": {
+        "fileMatch": ["flux/.+\\.ya?ml$"]
+      },
+      "helm-values": {
+        "fileMatch": ["flux/.+\\.ya?ml$"]
+      },
+      "kubernetes": {
+        "fileMatch": ["flux/.+\\.ya?ml$"]
+      },
+      "hostRules": [
+        {
+          "hostType": "docker",
+          "matchHost": "ghcr.io",
+          "username": "NULLx76",
+          "password": process.env.GITHUB_COM_TOKEN
+        }
+      ],
+      "packageRules": [
+        {
+          "automerge": true,
+          "automergeType": "branch",
+          "matchPackageNames": [
+            "renovate/renovate"
+          ]
+        }
+      ],
+      // ignore individual fluxcd images
+      "ignoreDeps": [
+        "ghcr.io/fluxcd/helm-controller",
+        "ghcr.io/fluxcd/image-automation-controller",
+        "ghcr.io/fluxcd/image-reflector-controller",
+        "ghcr.io/fluxcd/kustomize-controller",
+        "ghcr.io/fluxcd/notification-controller",
+        "ghcr.io/fluxcd/source-controller"
+      ],
+      "regexManagers": [
+        {
+          "fileMatch": [
+            "flux/cluster/crds/traefik/.+\\.ya?ml$"
+          ],
+          "matchStrings": [
+            "registryUrl=(?<registryUrl>.*?) chart=(?<depName>.*?)\n *tag: v(?<currentValue>.*)\n"
+          ],
+          "datasourceTemplate": "helm"
+        },
+        {
+          "fileMatch": [
+            "flux/cluster/crds/external-secrets/.+\\.ya?ml$"
+          ],
+          "matchStrings": [
+            "registryUrl=(?<registryUrl>.*?) chart=(?<depName>.*?)\n *tag: helm-chart-(?<currentValue>.*)\n"
+          ],
+          "datasourceTemplate": "helm"
+        },
+      ]
+    };

flux/olympus/core/namespaces/kustomization.yaml

@@ -3,3 +3,4 @@ kind: Kustomization
 resources:
   - websites.yaml
   - security.yaml
+  - services.yaml

flux/olympus/core/namespaces/services.yaml

@@ -0,0 +1,5 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: services