From c174a267642e49f84456829766803a3b2873ebf5 Mon Sep 17 00:00:00 2001 From: Oleksandr Berezovskyi Date: Mon, 11 May 2026 23:58:06 +0300 Subject: [PATCH] feat(k8s/gitea): add renovate support --- kubernetes/app/gitea/release.yaml | 17 ++++++++++++++- kubernetes/app/gitea/renovate.json | 33 ++++++++++++++++++++++++++++++ renovate.json | 3 ++- 3 files changed, 51 insertions(+), 2 deletions(-) create mode 100644 kubernetes/app/gitea/renovate.json diff --git a/kubernetes/app/gitea/release.yaml b/kubernetes/app/gitea/release.yaml index dddad70..f121b7c 100644 --- a/kubernetes/app/gitea/release.yaml +++ b/kubernetes/app/gitea/release.yaml @@ -21,15 +21,30 @@ spec: upgrade: remediation: retries: 3 + # Patch the init script: Gitea 1.26 removed environment-to-ini; use built-in subcommand instead. + # Remove once helm-gitea chart ships a release with the fix (commit 1baf2d0). + postRenderers: + - kustomize: + patches: + - target: + kind: Secret + name: gitea-gitea + patch: | + - op: replace + path: /data/config_environment.sh + value: IyEvdXNyL2Jpbi9lbnYgYmFzaApzZXQgLWV1byBwaXBlZmFpbAoKZnVuY3Rpb24gZW52MmluaTo6bG9nKCkgewogIHByaW50ZiAiJHsxfVxuIgp9CgpmdW5jdGlvbiBlbnYyaW5pOjpyZWFkX2NvbmZpZ190b19lbnYoKSB7CiAgbG9jYWwgc2VjdGlvbj0iJHsxfSIKICBsb2NhbCBsaW5lPSIkezJ9IgoKICBpZiBbWyAteiAiJHtsaW5lfSIgXV07IHRoZW4KICAgICMgc2tpcCBlbXB0eSBsaW5lCiAgICByZXR1cm4KICBmaQoKICAjICd4YXJncyBlY2hvIC1uJyB0cmltcyBhbGwgbGVhZGluZy90cmFpbGluZyB3aGl0ZXNwYWNlcyBhbmQgYSB0cmFpbGluZyBuZXcgbGluZQogIGxvY2FsIHNldHRpbmc9IiQoYXdrIC1GICc9JyAne3ByaW50ICQxfScgPDw8ICIke2xpbmV9IiB8IHhhcmdzIGVjaG8gLW4pIgoKICBpZiBbWyAteiAiJHtzZXR0aW5nfSIgXV07IHRoZW4KICAgIGVudjJpbmk6OmxvZyAnICAhIGludmFsaWQgc2V0dGluZycKICAgIGV4aXQgMQogIGZpCgogIGxvY2FsIHZhbHVlPScnCiAgbG9jYWwgcmVnZXg9Il4ke3NldHRpbmd9KFxzKik9KFxzKikoLiopIgogIGlmIFtbICRsaW5lID1+ICRyZWdleCBdXTsgdGhlbgogICAgdmFsdWU9IiR7QkFTSF9SRU1BVENIWzNdfSIKICBlbHNlCiAgICBlbnYyaW5pOjpsb2cgJyAgISBpbnZhbGlkIHNldHRpbmcnCiAgICBleGl0IDEKICBmaQoKICBlbnYyaW5pOjpsb2cgIiAgICArICcke3NldHRpbmd9JyIKCiAgaWYgW1sgLXogIiR7c2VjdGlvbn0iIF1dOyB0aGVuCiAgICBleHBvcnQgIkdJVEVBX19fXyR7c2V0dGluZ15efT0ke3ZhbHVlfSIgICAgICAgICAgICAgICAgICAgICAgICAgICAjICdeXicgbWFrZXMgdGhlIHZhcmlhYmxlIGNvbnRlbnQgdXBwZXJjYXNlCiAgICByZXR1cm4KICBmaQoKICBsb2NhbCBtYXNrZWRfc2VjdGlvbj0iJHtzZWN0aW9uLy8uL18wWDJFX30iICAgICAgICAgICAgICAgICAgICAgICAgICAgICMgJy8vJyBpbnN0cnVjdHMgdG8gcmVwbGFjZSBhbGwgbWF0Y2hlcwogIG1hc2tlZF9zZWN0aW9uPSIke21hc2tlZF9zZWN0aW9uLy8tL18wWDJEX30iCgogIGV4cG9ydCAiR0lURUFfXyR7bWFza2VkX3NlY3Rpb25eXn1fXyR7c2V0dGluZ15efT0ke3ZhbHVlfSIgICAgICAgICMgJ15eJyBtYWtlcyB0aGUgdmFyaWFibGUgY29udGVudCB1cHBlcmNhc2UKfQoKZnVuY3Rpb24gZW52MmluaTo6cmVsb2FkX3ByZXNldF9lbnZzKCkgewogIGVudjJpbmk6OmxvZyAiUmVsb2FkaW5nIHByZXNldCBlbnZzLi4uIgoKICB3aGlsZSByZWFkIC1yIGxpbmU7IGRvCiAgICBpZiBbWyAteiAiJHtsaW5lfSIgXV07IHRoZW4KICAgICAgIyBza2lwIGVtcHR5IGxpbmUKICAgICAgcmV0dXJuCiAgICBmaQoKICAgICMgJ3hhcmdzIGVjaG8gLW4nIHRyaW1zIGFsbCBsZWFkaW5nL3RyYWlsaW5nIHdoaXRlc3BhY2VzIGFuZCBhIHRyYWlsaW5nIG5ldyBsaW5lCiAgICBsb2NhbCBzZXR0aW5nPSIkKGF3ayAtRiAnPScgJ3twcmludCAkMX0nIDw8PCAiJHtsaW5lfSIgfCB4YXJncyBlY2hvIC1uKSIKCiAgICBpZiBbWyAteiAiJHtzZXR0aW5nfSIgXV07IHRoZW4KICAgICAgZW52MmluaTo6bG9nICcgICEgaW52YWxpZCBzZXR0aW5nJwogICAgICBleGl0IDEKICAgIGZpCgogICAgbG9jYWwgdmFsdWU9JycKICAgIGxvY2FsIHJlZ2V4PSJeJHtzZXR0aW5nfShccyopPShccyopKC4qKSIKICAgIGlmIFtbICRsaW5lID1+ICRyZWdleCBdXTsgdGhlbgogICAgICB2YWx1ZT0iJHtCQVNIX1JFTUFUQ0hbM119IgogICAgZWxzZQogICAgICBlbnYyaW5pOjpsb2cgJyAgISBpbnZhbGlkIHNldHRpbmcnCiAgICAgIGV4aXQgMQogICAgZmkKCiAgICBlbnYyaW5pOjpsb2cgIiAgKyAnJHtzZXR0aW5nfSciCgogICAgZXhwb3J0ICIke3NldHRpbmdeXn09JHt2YWx1ZX0iICAgICAgICAgICAgICAgICAgICAgICAgICAgIyAnXl4nIG1ha2VzIHRoZSB2YXJpYWJsZSBjb250ZW50IHVwcGVyY2FzZQogIGRvbmUgPCAiJFRNUF9FWElTVElOR19FTlZTX0ZJTEUiCgogIHJtICRUTVBfRVhJU1RJTkdfRU5WU19GSUxFCn0KCgpmdW5jdGlvbiBlbnYyaW5pOjpwcm9jZXNzX2NvbmZpZ19maWxlKCkgewogIGxvY2FsIGNvbmZpZ19maWxlPSIkezF9IgogIGxvY2FsIHNlY3Rpb249IiQoYmFzZW5hbWUgIiR7Y29uZmlnX2ZpbGV9IikiCgogIGlmIFtbICRzZWN0aW9uID09ICdfZ2VuZXJhbHNfJyBdXTsgdGhlbgogICAgZW52MmluaTo6bG9nICIgIFtpbmkgcm9vdF0iCiAgICBzZWN0aW9uPScnCiAgZWxzZQogICAgZW52MmluaTo6bG9nICIgICR7c2VjdGlvbn0iCiAgZmkKCiAgd2hpbGUgcmVhZCAtciBsaW5lOyBkbwogICAgZW52MmluaTo6cmVhZF9jb25maWdfdG9fZW52ICIke3NlY3Rpb259IiAiJHtsaW5lfSIKICBkb25lIDwgPChhd2sgMSAiJHtjb25maWdfZmlsZX0iKSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIyBIZWxtIC50b1lhbWwgdHJpbXMgdGhlIHRyYWlsaW5nIG5ldyBsaW5lIHdoaWNoIGJyZWFrcyBsaW5lIHByb2Nlc3Npbmc7IGF3ayAxIC4uLiBhZGRzIGl0IGJhY2sgd2hpbGUgcmVhZGluZwp9CgpmdW5jdGlvbiBlbnYyaW5pOjpsb2FkX2NvbmZpZ19zb3VyY2VzKCkgewogIGxvY2FsIHBhdGg9IiR7MX0iCgogIGlmIFtbIC1kICIke3BhdGh9IiBdXTsgdGhlbgogICAgZW52MmluaTo6bG9nICJQcm9jZXNzaW5nICQoYmFzZW5hbWUgIiR7cGF0aH0iKS4uLiIKCiAgICB3aGlsZSByZWFkIC1kICcnIGNvbmZpZ0ZpbGU7IGRvCiAgICAgIGVudjJpbmk6OnByb2Nlc3NfY29uZmlnX2ZpbGUgIiR7Y29uZmlnRmlsZX0iCiAgICBkb25lIDwgPChmaW5kICIke3BhdGh9IiAtdHlwZSBsIC1ub3QgLW5hbWUgJy4uZGF0YScgLXByaW50MCkKCiAgICBlbnYyaW5pOjpsb2cgIlxuIgogIGZpCn0KCmZ1bmN0aW9uIGVudjJpbmk6OmdlbmVyYXRlX2luaXRpYWxfc2VjcmV0cygpIHsKICAjIFRoZXNlIGVudmlyb25tZW50IHZhcmlhYmxlcyB3aWxsIGVpdGhlciBiZQogICMgICAtIG92ZXJ3cml0dGVuIHdpdGggdXNlciBkZWZpbmVkIHZhbHVlcywKICAjICAgLSBpbml0aWFsbHkgdXNlZCB0byBzZXQgdXAgR2l0ZWEKICAjIEFueXdheSwgdGhleSB3b24ndCBoYXJtIGV4aXN0aW5nIGFwcC5pbmkgZmlsZXMKCiAgZXhwb3J0IEdJVEVBX19TRUNVUklUWV9fSU5URVJOQUxfVE9LRU49JChnaXRlYSBnZW5lcmF0ZSBzZWNyZXQgSU5URVJOQUxfVE9LRU4pCiAgZXhwb3J0IEdJVEVBX19TRUNVUklUWV9fU0VDUkVUX0tFWT0kKGdpdGVhIGdlbmVyYXRlIHNlY3JldCBTRUNSRVRfS0VZKQogIGV4cG9ydCBHSVRFQV9fT0FVVEgyX19KV1RfU0VDUkVUPSQoZ2l0ZWEgZ2VuZXJhdGUgc2VjcmV0IEpXVF9TRUNSRVQpCiAgZXhwb3J0IEdJVEVBX19TRVJWRVJfX0xGU19KV1RfU0VDUkVUPSQoZ2l0ZWEgZ2VuZXJhdGUgc2VjcmV0IExGU19KV1RfU0VDUkVUKQoKICBlbnYyaW5pOjpsb2cgIi4uLkluaXRpYWwgc2VjcmV0cyBnZW5lcmF0ZWRcbiIKfQoKIyBzYXZlIGV4aXN0aW5nIGVudnMgcHJpb3IgdG8gc2NyaXB0IGV4ZWN1dGlvbi4gTmVjZXNzYXJ5IHRvIGtlZXAgb3JkZXIgb2YgcHJlZXhpc3RpbmcgYW5kIGN1c3RvbSBlbnZzCmVudiB8IChncmVwIC1lICdeR0lURUFfXycgfHwgW1sgJD8gPT0gMSBdXSkgPiAkVE1QX0VYSVNUSU5HX0VOVlNfRklMRQoKIyBNVVNUIEJFIENBTExFRCBCRUZPUkUgT1RIRVIgQ09ORklHVVJBVElPTgplbnYyaW5pOjpnZW5lcmF0ZV9pbml0aWFsX3NlY3JldHMKCmVudjJpbmk6OmxvYWRfY29uZmlnX3NvdXJjZXMgIiRFTlZfVE9fSU5JX01PVU5UX1BPSU5UL2lubGluZXMvIgplbnYyaW5pOjpsb2FkX2NvbmZpZ19zb3VyY2VzICIkRU5WX1RPX0lOSV9NT1VOVF9QT0lOVC9hZGRpdGlvbmFscy8iCgojIGxvYWQgZXhpc3RpbmcgZW52cyB0byBvdmVycmlkZSBhdXRvIGdlbmVyYXRlZCBlbnZzCmVudjJpbmk6OnJlbG9hZF9wcmVzZXRfZW52cwoKZW52MmluaTo6bG9nICI9PT0gQWxsIGNvbmZpZ3VyYXRpb24gc291cmNlcyBsb2FkZWQgPT09XG4iCgojIHNhZmV0eSB0byBwcmV2ZW50IHJld3JpdGUgb2Ygc2VjcmV0IGtleXMgaWYgYW4gYXBwLmluaSBhbHJlYWR5IGV4aXN0cwppZiBbIC1mICR7R0lURUFfQVBQX0lOSX0gXTsgdGhlbgogIGVudjJpbmk6OmxvZyAnQW4gYXBwLmluaSBmaWxlIGFscmVhZHkgZXhpc3RzLiBUbyBwcmV2ZW50IG92ZXJ3cml0aW5nIHNlY3JldCBrZXlzLCB0aGVzZSBzZXR0aW5ncyBhcmUgZHJvcHBlZCBhbmQgcmVtYWluIHVuY2hhbmdlZDonCiAgZW52MmluaTo6bG9nICcgIC0gc2VjdXJpdHkuSU5URVJOQUxfVE9LRU4nCiAgZW52MmluaTo6bG9nICcgIC0gc2VjdXJpdHkuU0VDUkVUX0tFWScKICBlbnYyaW5pOjpsb2cgJyAgLSBvYXV0aDIuSldUX1NFQ1JFVCcKICBlbnYyaW5pOjpsb2cgJyAgLSBzZXJ2ZXIuTEZTX0pXVF9TRUNSRVQnCgogIHVuc2V0IEdJVEVBX19TRUNVUklUWV9fSU5URVJOQUxfVE9LRU4KICB1bnNldCBHSVRFQV9fU0VDVVJJVFlfX1NFQ1JFVF9LRVkKICB1bnNldCBHSVRFQV9fT0FVVEgyX19KV1RfU0VDUkVUCiAgdW5zZXQgR0lURUFfX1NFUlZFUl9fTEZTX0pXVF9TRUNSRVQKZmkKCmdpdGVhIGNvbmZpZyBlZGl0LWluaSAtLWFwcGx5LWVudiAtLWNvbmZpZyAiJEdJVEVBX0FQUF9JTkkiIC0tb3V0ICIkR0lURUFfQVBQX0lOSSIK values: strategy: - type: Recreate + type: RollingUpdate podSecurityContext: seccompProfile: type: RuntimeDefault image: + # renovate: currentValue=1.26.1-rootless currentDigest=sha256:d671880e8fd3e337ea7ce3870bfe8fd37709060cd48224e4df2501c141b85443 + tag: 1.26.1 + digest: sha256:d671880e8fd3e337ea7ce3870bfe8fd37709060cd48224e4df2501c141b85443 rootless: true pullPolicy: IfNotPresent diff --git a/kubernetes/app/gitea/renovate.json b/kubernetes/app/gitea/renovate.json new file mode 100644 index 0000000..8e1ce22 --- /dev/null +++ b/kubernetes/app/gitea/renovate.json @@ -0,0 +1,33 @@ +{ + "customManagers": [ + { + "customType": "regex", + "description": "Track gitea rootless image; chart appends -rootless to tag automatically", + "fileMatch": ["kubernetes/app/gitea/release\\.yaml$"], + "matchStrings": [ + "(?\\s+)# renovate: currentValue=(?[^\\s]+) currentDigest=(?sha256:[a-f0-9]+)\\n\\s+tag: [^\\s]+\\n\\s+digest: [^\\s]+" + ], + "depNameTemplate": "gitea/gitea", + "datasourceTemplate": "docker", + "autoReplaceStringTemplate": "{{indentation}}# renovate: currentValue={{newValue}} currentDigest={{#if newDigest}}{{{newDigest}}}{{else}}{{{currentDigest}}}{{/if}}\n{{indentation}}tag: {{newMajor}}.{{newMinor}}.{{newPatch}}\n{{indentation}}digest: {{#if newDigest}}{{{newDigest}}}{{else}}{{{currentDigest}}}{{/if}}" + } + ], + "packageRules": [ + { + "matchFileNames": ["kubernetes/app/gitea/**"], + "semanticCommitScope": "k8s/gitea" + }, + { + "matchFileNames": ["kubernetes/app/gitea/**"], + "matchPackageNames": ["gitea/gitea"], + "matchUpdateTypes": ["patch", "minor"], + "automerge": true + }, + { + "description": "Ignore infrastructure images", + "matchFileNames": ["kubernetes/app/gitea/**"], + "matchPackageNames": ["creativeprojects/resticprofile", "postgres"], + "enabled": false + } + ] +} diff --git a/renovate.json b/renovate.json index 868735c..a9bea1d 100644 --- a/renovate.json +++ b/renovate.json @@ -5,7 +5,8 @@ ":semanticCommits", "local>oleksandr/homelab//kubernetes/app/jellyfin/renovate.json", "local>oleksandr/homelab//kubernetes/app/media/renovate.json", - "local>oleksandr/homelab//kubernetes/app/immich/renovate.json" + "local>oleksandr/homelab//kubernetes/app/immich/renovate.json", + "local>oleksandr/homelab//kubernetes/app/gitea/renovate.json" ], "enabledManagers": ["kubernetes", "custom.regex"], "automergeType": "branch",