From 180bc501e54ec7833c98bbbfd546092906c11285 Mon Sep 17 00:00:00 2001 From: Benjamin Ritter Date: Fri, 21 Aug 2026 16:27:15 +0200 Subject: [PATCH 01/10] feat: add renovate Add renovate running as a github action Updates go packages and the go version in go.mod, github actions and docker images. Signed-off-by: Benjamin Ritter --- .github/renovate.json5 | 43 +++++++++++++++++++++++++++++ .github/workflows/renovate.yaml | 49 +++++++++++++++++++++++++++++++++ Makefile | 3 ++ 3 files changed, 95 insertions(+) create mode 100644 .github/renovate.json5 create mode 100644 .github/workflows/renovate.yaml diff --git a/.github/renovate.json5 b/.github/renovate.json5 new file mode 100644 index 00000000..592d09e4 --- /dev/null +++ b/.github/renovate.json5 @@ -0,0 +1,43 @@ +{ + $schema: "https://docs.renovatebot.com/renovate-schema.json", + extends: [ + "config:recommended", + ], + labels: ["dependencies"], + postUpdateOptions: ["gomodTidy"], + packageRules: [ + { + // Make sure to update go in the Makefile, go.mod and workflows + groupName: "golang", + matchDatasources: ["docker", "golang-version"], + matchPackageNames: ["go", "golang"], + }, + { + // Make sure the K8s library versions line up + groupName: "kubernetes", + matchManagers: ["gomod"], + matchPackageNames: [ + "k8s.io/**", + "sigs.k8s.io/controller-runtime", + "sigs.k8s.io/controller-tools", + ], + }, + { + // Combine github actions updates + groupName: "github-actions", + matchManagers: ["github-actions"], + }, + ], + customManagers: [ + { + // Tool versions pinned in the Makefile, annotated with + // "# renovate: datasource=... depName=..." right above them. + // Stolen from https://docs.renovatebot.com/presets-customManagers/ + customType: "regex", + managerFilePatterns: ["/^Makefile$/"], + matchStrings: [ + "#\\s*renovate:\\s*datasource=(?\\S+)\\s+depName=(?\\S+)(?:\\s+versioning=(?\\S+))?(?:\\s+extractVersion=(?\\S+))?\\s*\\n\\s*[A-Z_]+\\s*[:?]?=\\s*(?\\S+)", + ], + }, + ], +} diff --git a/.github/workflows/renovate.yaml b/.github/workflows/renovate.yaml new file mode 100644 index 00000000..1102ab5f --- /dev/null +++ b/.github/workflows/renovate.yaml @@ -0,0 +1,49 @@ +--- +name: Renovate + +on: + schedule: + # Every day at 04:00 UTC. + - cron: '0 4 * * *' + workflow_dispatch: + inputs: + logLevel: + description: 'Renovate log level' + required: false + default: 'info' + type: choice + options: + - info + - debug + dryRun: + description: 'Run without creating branches, PRs or issues' + required: false + default: false + type: boolean + +concurrency: + group: renovate + cancel-in-progress: false + +jobs: + renovate: + runs-on: ubuntu-latest + permissions: + pull-requests: write + contents: read + steps: + - name: Renovate + uses: renovatebot/github-action@v46.2.2 + with: {} + # Needs a PAT (repo + workflow scope) or a GitHub App token, not the + # default GITHUB_TOKEN: that one may neither update files below + # .github/workflows nor trigger the CI workflows on the PRs it opens. + # Currently disabled for testing purposes + # token: ${{ secrets.RENOVATE_TOKEN }} + env: + RENOVATE_REPOSITORIES: ${{ github.repository }} + # Configuration lives in .github/renovate.json5, no onboarding PR. + RENOVATE_ONBOARDING: 'false' + RENOVATE_REQUIRE_CONFIG: 'required' + RENOVATE_DRY_RUN: ${{ inputs.dryRun && 'full' || 'null' }} + LOG_LEVEL: ${{ inputs.logLevel || 'info' }} diff --git a/Makefile b/Makefile index 729b5e1a..8884dc89 100644 --- a/Makefile +++ b/Makefile @@ -16,9 +16,11 @@ BUILDDATE := $(shell date -Iseconds) VERSION := $(or ${DOCKER_TAG},latest) LOCALBIN ?= $(shell pwd)/bin CONTROLLER_GEN ?= $(LOCALBIN)/controller-gen +# renovate: datasource=go depName=sigs.k8s.io/controller-tools CONTROLLER_TOOLS_VERSION ?= v0.21.0 # Postgres operator variables for YAML download +# renovate: datasource=github-releases depName=zalando/postgres-operator POSTGRES_OPERATOR_VERSION ?= v2.0.2 POSTGRES_OPERATOR_URL ?= https://raw.githubusercontent.com/zalando/postgres-operator/$(POSTGRES_OPERATOR_VERSION)/manifests POSTGRES_CRD_URL ?= https://raw.githubusercontent.com/zalando/postgres-operator/$(POSTGRES_OPERATOR_VERSION)/charts/postgres-operator/crds/postgresqls.yaml @@ -186,6 +188,7 @@ localkube-install-crd-cwnp: crd-cwnp-for-testing: curl https://raw.githubusercontent.com/metal-stack/firewall-controller/master/config/crd/bases/metal-stack.io_clusterwidenetworkpolicies.yaml -o external/test/crd-clusterwidenetworkpolicy.yaml +# renovate: datasource=github-releases depName=kubernetes-sigs/kubebuilder extractVersion=^v(?.*)$ KUBEBUILDER_VERSION:=3.2.0 kubebuilder: ifeq (,$(wildcard ~/.kubebuilder/${KUBEBUILDER_VERSION})) From 6e5f6e292264b8e90c817c74a3d0fa27efd0809b Mon Sep 17 00:00:00 2001 From: Benjamin Ritter Date: Fri, 21 Aug 2026 16:53:00 +0200 Subject: [PATCH 02/10] fix: add zalando postgres operator versioning group Signed-off-by: Benjamin Ritter --- .github/renovate.json5 | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/.github/renovate.json5 b/.github/renovate.json5 index 592d09e4..b2bb66b3 100644 --- a/.github/renovate.json5 +++ b/.github/renovate.json5 @@ -22,6 +22,15 @@ "sigs.k8s.io/controller-tools", ], }, + { + // The zalando postgres-operator is both a go dependency and the source + // of the YAML manifests downloaded via the Makefile + groupName: "zalando postgres-operator", + matchPackageNames: [ + "github.com/zalando/postgres-operator", + "zalando/postgres-operator", + ], + }, { // Combine github actions updates groupName: "github-actions", From a8cf4b516f8b4e3139fc78cfd3ca6a82a987fdc0 Mon Sep 17 00:00:00 2001 From: Benjamin Ritter Date: Fri, 21 Aug 2026 16:53:29 +0200 Subject: [PATCH 03/10] fix: fix controller-tools not being versioned together with the other k8s deps Signed-off-by: Benjamin Ritter --- .github/renovate.json5 | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/.github/renovate.json5 b/.github/renovate.json5 index b2bb66b3..a3cc5845 100644 --- a/.github/renovate.json5 +++ b/.github/renovate.json5 @@ -13,9 +13,11 @@ matchPackageNames: ["go", "golang"], }, { - // Make sure the K8s library versions line up + // Make sure the K8s library versions line up. Consciously not scoped to + // matchManagers "gomod": controller-tools is pinned in the Makefile and + // picked up by the custom manager below, so a gomod scope would leave it + // out of the group groupName: "kubernetes", - matchManagers: ["gomod"], matchPackageNames: [ "k8s.io/**", "sigs.k8s.io/controller-runtime", From 9d35dbaa9b771906550fca206fbc36a082e96512 Mon Sep 17 00:00:00 2001 From: Benjamin Ritter Date: Fri, 21 Aug 2026 17:01:16 +0200 Subject: [PATCH 04/10] WIP: dry-run test via github actions Signed-off-by: Benjamin Ritter --- .github/workflows/renovate.yaml | 18 +++++++++++++----- 1 file changed, 13 insertions(+), 5 deletions(-) diff --git a/.github/workflows/renovate.yaml b/.github/workflows/renovate.yaml index 1102ab5f..d17b5cb1 100644 --- a/.github/workflows/renovate.yaml +++ b/.github/workflows/renovate.yaml @@ -5,6 +5,9 @@ on: schedule: # Every day at 04:00 UTC. - cron: '0 4 * * *' + push: + branches: + - feat/renovate workflow_dispatch: inputs: logLevel: @@ -29,12 +32,16 @@ jobs: renovate: runs-on: ubuntu-latest permissions: - pull-requests: write contents: read + pull-requests: read steps: + # Only required for testing on push + - name: Checkout + uses: actions/checkout@v4 - name: Renovate uses: renovatebot/github-action@v46.2.2 - with: {} + with: + configurationFile: .github/renovate.json5 # Needs a PAT (repo + workflow scope) or a GitHub App token, not the # default GITHUB_TOKEN: that one may neither update files below # .github/workflows nor trigger the CI workflows on the PRs it opens. @@ -42,8 +49,9 @@ jobs: # token: ${{ secrets.RENOVATE_TOKEN }} env: RENOVATE_REPOSITORIES: ${{ github.repository }} - # Configuration lives in .github/renovate.json5, no onboarding PR. + RENOVATE_TOKEN: ${{ secrets.GITHUB_TOKEN }} RENOVATE_ONBOARDING: 'false' - RENOVATE_REQUIRE_CONFIG: 'required' - RENOVATE_DRY_RUN: ${{ inputs.dryRun && 'full' || 'null' }} + RENOVATE_REQUIRE_CONFIG: ${{ github.event_name == 'push' && 'optional' || 'required' }} + RENOVATE_BASE_BRANCH_PATTERNS: ${{ github.event_name == 'push' && github.ref_name || '' }} + RENOVATE_DRY_RUN: ${{ github.event_name == 'push' && 'full' || (inputs.dryRun && 'full' || 'null') }} LOG_LEVEL: ${{ inputs.logLevel || 'info' }} From 9fc985d0d99f7dfe4076b352a5ca1f9b4c6786bc Mon Sep 17 00:00:00 2001 From: Benjamin Ritter Date: Thu, 3 Sep 2026 10:07:27 +0200 Subject: [PATCH 05/10] feat: use github app for authentication Signed-off-by: Benjamin Ritter --- .github/workflows/renovate.yaml | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/.github/workflows/renovate.yaml b/.github/workflows/renovate.yaml index d17b5cb1..db361603 100644 --- a/.github/workflows/renovate.yaml +++ b/.github/workflows/renovate.yaml @@ -35,6 +35,12 @@ jobs: contents: read pull-requests: read steps: + - name: Get token + id: get_token + uses: actions/create-github-app-token@v1 + with: + private-key: ${{ secrets.RENOVATE_APP_PRIVATE_KEY }} + app-id: ${{ secrets.RENOVATE_APP_CLIENT_ID }} # Only required for testing on push - name: Checkout uses: actions/checkout@v4 @@ -42,14 +48,9 @@ jobs: uses: renovatebot/github-action@v46.2.2 with: configurationFile: .github/renovate.json5 - # Needs a PAT (repo + workflow scope) or a GitHub App token, not the - # default GITHUB_TOKEN: that one may neither update files below - # .github/workflows nor trigger the CI workflows on the PRs it opens. - # Currently disabled for testing purposes - # token: ${{ secrets.RENOVATE_TOKEN }} + token: '${{ steps.get_token.outputs.token }}' env: RENOVATE_REPOSITORIES: ${{ github.repository }} - RENOVATE_TOKEN: ${{ secrets.GITHUB_TOKEN }} RENOVATE_ONBOARDING: 'false' RENOVATE_REQUIRE_CONFIG: ${{ github.event_name == 'push' && 'optional' || 'required' }} RENOVATE_BASE_BRANCH_PATTERNS: ${{ github.event_name == 'push' && github.ref_name || '' }} From b4a440ad425f6ea57fc93c3f02c61f9c8c56ba40 Mon Sep 17 00:00:00 2001 From: Benjamin Ritter Date: Thu, 3 Sep 2026 17:37:57 +0200 Subject: [PATCH 06/10] fix: fix overlapping k8s update rules Signed-off-by: Benjamin Ritter --- .github/renovate.json5 | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/.github/renovate.json5 b/.github/renovate.json5 index a3cc5845..3777d4a5 100644 --- a/.github/renovate.json5 +++ b/.github/renovate.json5 @@ -16,8 +16,14 @@ // Make sure the K8s library versions line up. Consciously not scoped to // matchManagers "gomod": controller-tools is pinned in the Makefile and // picked up by the custom manager below, so a gomod scope would leave it - // out of the group - groupName: "kubernetes", + // out of the group. + // The group name deliberately matches the "kubernetes monorepo" group + // that config:recommended (group:monorepos) creates for k8s.io/api, + // apiextensions-apiserver, apimachinery and client-go. That built-in rule + // wins over this one for those four packages, so using the same name is + // what keeps them in one group together with the rest below instead of + // splitting into renovate/kubernetes and renovate/kubernetes-monorepo + groupName: "kubernetes monorepo", matchPackageNames: [ "k8s.io/**", "sigs.k8s.io/controller-runtime", From 97b27ffb4291e63e3810bccbd9347a0117bd179f Mon Sep 17 00:00:00 2001 From: Benjamin Ritter Date: Fri, 25 Sep 2026 16:34:45 +0200 Subject: [PATCH 07/10] fix: group k8s go updates Signed-off-by: Benjamin Ritter --- .github/renovate.json5 | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-) diff --git a/.github/renovate.json5 b/.github/renovate.json5 index 3777d4a5..05259201 100644 --- a/.github/renovate.json5 +++ b/.github/renovate.json5 @@ -3,6 +3,10 @@ extends: [ "config:recommended", ], + // We define a wider Kubernetes group below. Excluding Renovate's built-in + // Kubernetes monorepo group prevents the same update from being assigned to + // both groups and producing overlapping branches/PRs. + ignorePresets: ["group:kubernetesMonorepo"], labels: ["dependencies"], postUpdateOptions: ["gomodTidy"], packageRules: [ @@ -13,17 +17,12 @@ matchPackageNames: ["go", "golang"], }, { - // Make sure the K8s library versions line up. Consciously not scoped to + // Keep the K8s library versions aligned. Consciously not scoped to // matchManagers "gomod": controller-tools is pinned in the Makefile and // picked up by the custom manager below, so a gomod scope would leave it // out of the group. - // The group name deliberately matches the "kubernetes monorepo" group - // that config:recommended (group:monorepos) creates for k8s.io/api, - // apiextensions-apiserver, apimachinery and client-go. That built-in rule - // wins over this one for those four packages, so using the same name is - // what keeps them in one group together with the rest below instead of - // splitting into renovate/kubernetes and renovate/kubernetes-monorepo - groupName: "kubernetes monorepo", + groupName: "kubernetes", + groupSlug: "kubernetes", matchPackageNames: [ "k8s.io/**", "sigs.k8s.io/controller-runtime", From 9a376ad10c45d218c1f9db3ac279a93cd653d17b Mon Sep 17 00:00:00 2001 From: Benjamin Ritter Date: Fri, 25 Sep 2026 16:35:19 +0200 Subject: [PATCH 08/10] chore: update dependencies Signed-off-by: Benjamin Ritter --- .github/workflows/latest.yaml | 2 +- .github/workflows/release.yaml | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/latest.yaml b/.github/workflows/latest.yaml index 524d579f..34276ef4 100644 --- a/.github/workflows/latest.yaml +++ b/.github/workflows/latest.yaml @@ -20,7 +20,7 @@ jobs: password: ${{ secrets.DOCKER_REGISTRY_TOKEN }} - name: Ensure Go Version - uses: actions/setup-go@v4 + uses: actions/setup-go@v5 with: go-version-file: 'go.mod' diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index 3110ea38..a1ed861b 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -10,7 +10,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v3 + uses: actions/checkout@v4 - name: Docker Login uses: docker/login-action@v3 @@ -21,7 +21,7 @@ jobs: - name: Ensure Go Version - uses: actions/setup-go@v4 + uses: actions/setup-go@v5 with: go-version-file: 'go.mod' From 932bf0c4ba68b65a3647cccb97931dd24cf9b336 Mon Sep 17 00:00:00 2001 From: Benjamin Ritter Date: Fri, 25 Sep 2026 16:36:20 +0200 Subject: [PATCH 09/10] feat: remove dry-run logic Signed-off-by: Benjamin Ritter --- .github/workflows/renovate.yaml | 10 ++-------- 1 file changed, 2 insertions(+), 8 deletions(-) diff --git a/.github/workflows/renovate.yaml b/.github/workflows/renovate.yaml index db361603..edb588a7 100644 --- a/.github/workflows/renovate.yaml +++ b/.github/workflows/renovate.yaml @@ -18,11 +18,6 @@ on: options: - info - debug - dryRun: - description: 'Run without creating branches, PRs or issues' - required: false - default: false - type: boolean concurrency: group: renovate @@ -41,7 +36,6 @@ jobs: with: private-key: ${{ secrets.RENOVATE_APP_PRIVATE_KEY }} app-id: ${{ secrets.RENOVATE_APP_CLIENT_ID }} - # Only required for testing on push - name: Checkout uses: actions/checkout@v4 - name: Renovate @@ -53,6 +47,6 @@ jobs: RENOVATE_REPOSITORIES: ${{ github.repository }} RENOVATE_ONBOARDING: 'false' RENOVATE_REQUIRE_CONFIG: ${{ github.event_name == 'push' && 'optional' || 'required' }} - RENOVATE_BASE_BRANCH_PATTERNS: ${{ github.event_name == 'push' && github.ref_name || '' }} - RENOVATE_DRY_RUN: ${{ github.event_name == 'push' && 'full' || (inputs.dryRun && 'full' || 'null') }} + RENOVATE_BASE_BRANCH_PATTERNS: ${{ github.ref_name }} + RENOVATE_DRY_RUN: 'full' LOG_LEVEL: ${{ inputs.logLevel || 'info' }} From 88f99e2cd63fb4ef6214c48eff09c69089c5adf0 Mon Sep 17 00:00:00 2001 From: Benjamin Ritter Date: Fri, 25 Sep 2026 16:37:04 +0200 Subject: [PATCH 10/10] feat: remove dependabot Signed-off-by: Benjamin Ritter --- .github/dependabot.yaml | 11 ----------- 1 file changed, 11 deletions(-) delete mode 100644 .github/dependabot.yaml diff --git a/.github/dependabot.yaml b/.github/dependabot.yaml deleted file mode 100644 index 98824083..00000000 --- a/.github/dependabot.yaml +++ /dev/null @@ -1,11 +0,0 @@ -# To get started with Dependabot version updates, you'll need to specify which -# package ecosystems to update and where the package manifests are located. -# Please see the documentation for all configuration options: -# https://help.github.com/github/administering-a-repository/configuration-options-for-dependency-updates - -version: 2 -updates: - - package-ecosystem: "gomod" # See documentation for possible values - directory: "/" # Location of package manifests - schedule: - interval: "daily" \ No newline at end of file