mirror of
https://github.com/cozystack/cozystack.git
synced 2026-10-30 08:37:31 +09:00
Алексей Артамонов
a76c5929fd
The post-delete cleanup Jobs in the harbor and mariadb charts hardcoded `docker.io/clastix/kubectl:v1.32` — a moving tag pulled directly from Docker Hub. This broke build reproducibility (the tag can be re-pushed), was a supply-chain risk, and could not be satisfied on air-gapped / mirrored clusters, where it failed at the worst moment: during uninstall, when the post-delete hook runs and stalls release teardown. Add a canonical `cozy-lib.image` helper that prefixes a registry-relative image path with `cozy-lib.images-registry` when set and returns it unchanged (no leading "/") when empty, so standard installs resolve from the default registry and mirrored installs resolve internally. Consume it from both cleanup hooks with the image digest-pinned to the immutable multi-arch index sha256:b9ef7d8dbe65bcc81a46c09b8dc7543103055021c4f43287bf59e92a8f4fe05c (the same digest already pinned for postgres-operator's webhook hook). Keep the pin fresh with a custom Renovate manager: the repo disables the helm-values manager (enabledManagers), and the ref is built at render time by the helper rather than being a Dockerfile/go.mod dependency, so the built-in managers cannot see it. A regex manager over the hook templates tracks clastix/kubectl by tag+digest — mirroring the existing extra/etcd manager — so the supply-chain pin does not silently age. Also harden `cozy-lib.images-registry` against a nil .Values._cluster so the helper never crashes the render — relevant precisely because the hook renders during teardown. Helm unit tests assert the rendered image (routed, digest-pinned, no leading slash) by pattern rather than an exact digest, so a Renovate bump keeps them green. Closes #3088 Assisted-By: Claude <noreply@anthropic.com> Signed-off-by: Алексей Артамонов <alexeyartamonov1987@gmail.com>
83 lines
5.5 KiB
JSON
83 lines
5.5 KiB
JSON
{
|
|
"$schema": "https://docs.renovatebot.com/renovate-schema.json",
|
|
"extends": [
|
|
"config:recommended",
|
|
":semanticCommits"
|
|
],
|
|
"enabledManagers": ["gomod", "dockerfile", "github-actions", "custom.regex"],
|
|
"postUpdateOptions": ["gomodTidy", "gomodUpdateImportPaths"],
|
|
"labels": ["automated", "do-not-merge/hold"],
|
|
"semanticCommitType": "chore",
|
|
"semanticCommitScope": "deps",
|
|
"automerge": false,
|
|
"platformAutomerge": false,
|
|
"prConcurrentLimit": 5,
|
|
"osvVulnerabilityAlerts": true,
|
|
"vulnerabilityAlerts": {
|
|
"enabled": true,
|
|
"labels": ["automated", "security"]
|
|
},
|
|
"customManagers": [
|
|
{
|
|
"customType": "regex",
|
|
"description": "Track the etcd image pinned in the extra/etcd EtcdCluster podTemplate. etcd-operator v0.4.5 bakes etcd 3.5.12 into its binary, and the chart overrides it with a hardcoded image string that the gomod/dockerfile managers cannot see. Without this manager the security-relevant pin (etcd 3.5.x releases are overwhelmingly security fixes) would silently age.",
|
|
"managerFilePatterns": ["/^packages/extra/etcd/templates/etcd-cluster\\.yaml$/"],
|
|
"matchStrings": ["image:\\s+(?<depName>quay\\.io/coreos/etcd):(?<currentValue>v[0-9]+\\.[0-9]+\\.[0-9]+)"],
|
|
"datasourceTemplate": "docker"
|
|
},
|
|
{
|
|
"customType": "regex",
|
|
"description": "Track and keep fresh the clastix/kubectl image digest-pinned in the post-delete cleanup hooks. The ref is assembled at render time by the cozy-lib.image helper (routed through cozy-lib.images-registry so mirrored / air-gapped installs resolve it), so it is neither a Dockerfile nor a go.mod dependency and the built-in managers cannot see it. The helm-values manager is disabled repo-wide (see enabledManagers above), so without this regex manager the digest — a supply-chain pin — would silently age.",
|
|
"managerFilePatterns": ["/^packages/.+/templates/hooks/.+\\.yaml$/"],
|
|
"matchStrings": ["clastix/kubectl:(?<currentValue>v[0-9]+\\.[0-9]+(?:\\.[0-9]+)?)@(?<currentDigest>sha256:[a-f0-9]+)"],
|
|
"datasourceTemplate": "docker",
|
|
"depNameTemplate": "docker.io/clastix/kubectl"
|
|
}
|
|
],
|
|
"packageRules": [
|
|
{
|
|
"description": "Force chore(deps) for all Go module bumps. config:recommended pulls in :semanticPrefixFixDepsChoreOthers, whose packageRule re-sets semanticCommitType=fix for direct deps (depType require), overriding the top-level chore. packageRules override top-level config, so a user rule evaluated last is required to win it back; without this, direct-dep PRs land as fix(deps) and get auto-labeled kind/bug.",
|
|
"matchManagers": ["gomod"],
|
|
"semanticCommitType": "chore",
|
|
"semanticCommitScope": "deps"
|
|
},
|
|
{
|
|
"description": "Bump indirect Go modules too. Transitive deps such as golang.org/x/crypto, golang.org/x/net and golang.org/x/sys carry OSV advisories that drive the OpenSSF Scorecard Vulnerabilities check to 0, but Renovate skips indirect gomod deps by default so they never get a PR. Grouped into one rolling PR to keep volume sane; security fixes are still split out by vulnerabilityAlerts above. Placed before the kubernetes rule on purpose: an indirect k8s.io/** dep matches both, and Renovate applies last-match-wins, so the later kubernetes rule keeps it in the kubernetes lockstep group.",
|
|
"matchManagers": ["gomod"],
|
|
"matchDepTypes": ["indirect"],
|
|
"enabled": true,
|
|
"groupName": "indirect go modules"
|
|
},
|
|
{
|
|
"description": "Keep controller-runtime and the Kubernetes libraries in lockstep. A split bump breaks compilation because a given controller-runtime release expects a matching client-go / apimachinery line.",
|
|
"groupName": "kubernetes",
|
|
"matchManagers": ["gomod"],
|
|
"matchPackageNames": ["sigs.k8s.io/controller-runtime", "k8s.io/**"]
|
|
},
|
|
{
|
|
"description": "Never bump the Go toolchain directive. go.mod is generated and the toolchain is pinned deliberately; raising it needs a matching setup-go and a codegen run, which is out of scope for an automated dependency bump.",
|
|
"matchManagers": ["gomod"],
|
|
"matchDepTypes": ["golang"],
|
|
"enabled": false
|
|
},
|
|
{
|
|
"description": "Pin Dockerfile base images and GitHub Actions to immutable digests so OpenSSF Scorecard Pinned-Dependencies passes and supply-chain refs stay reproducible. The tag is kept in front of the digest so it stays human-readable and trackable.",
|
|
"matchManagers": ["dockerfile", "github-actions"],
|
|
"pinDigests": true
|
|
},
|
|
{
|
|
"description": "Batch the initial pin and all digest-only refreshes (same tag, rebuilt upstream) into a single weekly PR. Without this, frequently-rebuilt bases (alpine, debian, golang, distroless) would trickle in one rebuild-triggering PR each, loading the shared CI runner. Real tag bumps (major/minor/patch) are intentionally left out of this group so they get individual review.",
|
|
"matchManagers": ["dockerfile", "github-actions"],
|
|
"matchUpdateTypes": ["digest", "pinDigest"],
|
|
"groupName": "container image & action digests",
|
|
"schedule": ["before 6am on monday"]
|
|
},
|
|
{
|
|
"description": "kubevirt.io/csi-driver is pinned to an untagged pseudo-version commit and publishes no release tags, so Renovate's go datasource returns no-result and the lookup failure lingers on the Dependency Dashboard. Disable it; this module is advanced deliberately alongside the kubevirt-csi-driver image build.",
|
|
"matchManagers": ["gomod"],
|
|
"matchPackageNames": ["kubevirt.io/csi-driver"],
|
|
"enabled": false
|
|
}
|
|
]
|
|
}
|