Skip to content

Commit 5fdb282

Browse files
lucastigeraclaude
lucastigera
and
claude
authored
Add Renovate bot to automate dependency updates (tigera#5004)
* Add Renovate bot to automate dependency updates Mirror projectcalico/calico's Renovate setup, adapted to the operator's file layout: a renovate.json config plus a .semaphore/renovate.yml pipeline run on a Semaphore schedule. Tracks the same safe, patch-focused dependency classes as calico: - Go modules: k8s.io/** (patch), golang.org/x/** (patch + minor), all other modules disabled; go mod tidy after each update. - Go language version: the "go x.y.z" directive in go.mod (golang-version). - calico/base: CALICO_BASE_VER in the Makefile (docker datasource, ubiN-<serial> versioning), tolerant of ?=. Updates are grouped into a single dependency-updates PR, minor/major/digest blocked globally, vulnerability alerts enabled. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * Makefile: decompose GO_BUILD_VER into GO_VERSION/K8S_VERSION/LLVM_VERSION Mirror projectcalico/calico's split of the monolithic go-build toolchain version into individually-addressable parts, so each can be tracked/bumped on its own. GO_BUILD_VER is rebuilt as a composite of the parts and resolves to the identical value (1.26.4-llvm21.1.8-k8s1.36.2); K8S_VERSION carries a leading "v" that is stripped on interpolation via $(K8S_VERSION:v%=%). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * renovate: track GO_VERSION and K8S_VERSION from the Makefile Now that GO_BUILD_VER is decomposed, add custom regex managers mirroring calico's: GO_VERSION -> golang (golang-version) and K8S_VERSION -> kubernetes/kubernetes (github-releases, v-prefix extract). Both are patch-only under the existing global minor/major/digest block and fold into the dependency-updates group. Managers point at the Makefile and tolerate ?=. Also updates the Semaphore secret to marvin-renovate-token-enterprise. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * Regenerate imported CRDs (make gen-versions) Sync the bundled calico/enterprise CRDs with upstream master to clear a pre-existing dirty-check failure: eck bundle version label 3.4.0 -> 3.4.1, plus felixconfigurations (v1 + v3) and wafpolicies content updates. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * renovate: use f1-standard-2 Semaphore VM Match the machine type used by every other operator pipeline (the f1-standard-4 was inherited from calico's heavier monorepo). Start small; bump back up if Renovate hits memory limits. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
1 parent 4e64c60 commit 5fdb282

4 files changed

Lines changed: 145 additions & 13 deletions

File tree

‎.semaphore/renovate.yml‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
version: v1.0
2+
name: Renovate update dependencies
3+
agent:
4+
machine:
5+
type: f1-standard-2
6+
os_image: ubuntu2204
7+
8+
execution_time_limit:
9+
hours: 2
10+
11+
global_job_config:
12+
secrets:
13+
- name: private-repo
14+
prologue:
15+
commands:
16+
- chmod 0600 ~/.keys/*
17+
- ssh-add ~/.keys/*
18+
- checkout
19+
20+
blocks:
21+
- name: Run Renovate
22+
task:
23+
secrets:
24+
- name: marvin-renovate-token-enterprise
25+
jobs:
26+
- name: Renovate
27+
env_vars:
28+
- name: RENOVATE_REPOSITORIES
29+
value: tigera/operator
30+
- name: RENOVATE_GIT_AUTHOR
31+
value: "marvin-tigera <marvin-tigera@users.noreply.github.com>"
32+
- name: LOG_LEVEL
33+
value: info
34+
commands:
35+
- nvm install 24 && nvm use 24
36+
- npm install -g renovate@43
37+
- renovate --platform=github --autodiscover=false

‎Makefile‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -101,7 +101,14 @@ endif
101101
REPO?=tigera/operator
102102
PACKAGE_NAME?=github.com/tigera/operator
103103
LOCAL_USER_ID?=$(shell id -u $$USER)
104-
GO_BUILD_VER?=1.26.4-llvm21.1.8-k8s1.36.2
104+
# The project Go version.
105+
GO_VERSION?=1.26.4
106+
# Version of Kubernetes to use for dependencies, tests, and kubectl.
107+
K8S_VERSION?=v1.36.2
108+
# The version of LLVM to use for the go-build image.
109+
LLVM_VERSION?=21.1.8
110+
# Calico toolchain versions and the calico/go-build image to use.
111+
GO_BUILD_VER?=$(GO_VERSION)-llvm$(LLVM_VERSION)-k8s$(K8S_VERSION:v%=%)
105112
CALICO_BASE_VER ?= ubi9-1781568165
106113
CALICO_BUILD?=calico/go-build:$(GO_BUILD_VER)-$(BUILDARCH)
107114
CALICO_BASE ?= calico/base:$(CALICO_BASE_VER)

‎pkg/imports/crds/enterprise/01-crd-eck-bundle.yaml‎

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ metadata:
99
labels:
1010
app.kubernetes.io/instance: 'elastic-operator'
1111
app.kubernetes.io/name: 'eck-operator-crds'
12-
app.kubernetes.io/version: '3.4.0'
12+
app.kubernetes.io/version: '3.4.1'
1313
name: agents.agent.k8s.elastic.co
1414
spec:
1515
group: agent.k8s.elastic.co
@@ -502,7 +502,7 @@ metadata:
502502
labels:
503503
app.kubernetes.io/instance: 'elastic-operator'
504504
app.kubernetes.io/name: 'eck-operator-crds'
505-
app.kubernetes.io/version: '3.4.0'
505+
app.kubernetes.io/version: '3.4.1'
506506
name: apmservers.apm.k8s.elastic.co
507507
spec:
508508
group: apm.k8s.elastic.co
@@ -1024,7 +1024,7 @@ metadata:
10241024
labels:
10251025
app.kubernetes.io/instance: 'elastic-operator'
10261026
app.kubernetes.io/name: 'eck-operator-crds'
1027-
app.kubernetes.io/version: '3.4.0'
1027+
app.kubernetes.io/version: '3.4.1'
10281028
name: autoopsagentpolicies.autoops.k8s.elastic.co
10291029
spec:
10301030
group: autoops.k8s.elastic.co
@@ -1184,7 +1184,7 @@ metadata:
11841184
labels:
11851185
app.kubernetes.io/instance: 'elastic-operator'
11861186
app.kubernetes.io/name: 'eck-operator-crds'
1187-
app.kubernetes.io/version: '3.4.0'
1187+
app.kubernetes.io/version: '3.4.1'
11881188
name: beats.beat.k8s.elastic.co
11891189
spec:
11901190
group: beat.k8s.elastic.co
@@ -1423,7 +1423,7 @@ metadata:
14231423
labels:
14241424
app.kubernetes.io/instance: 'elastic-operator'
14251425
app.kubernetes.io/name: 'eck-operator-crds'
1426-
app.kubernetes.io/version: '3.4.0'
1426+
app.kubernetes.io/version: '3.4.1'
14271427
name: elasticmapsservers.maps.k8s.elastic.co
14281428
spec:
14291429
group: maps.k8s.elastic.co
@@ -1680,7 +1680,7 @@ metadata:
16801680
labels:
16811681
app.kubernetes.io/instance: 'elastic-operator'
16821682
app.kubernetes.io/name: 'eck-operator-crds'
1683-
app.kubernetes.io/version: '3.4.0'
1683+
app.kubernetes.io/version: '3.4.1'
16841684
name: elasticsearchautoscalers.autoscaling.k8s.elastic.co
16851685
spec:
16861686
group: autoscaling.k8s.elastic.co
@@ -1937,7 +1937,7 @@ metadata:
19371937
labels:
19381938
app.kubernetes.io/instance: 'elastic-operator'
19391939
app.kubernetes.io/name: 'eck-operator-crds'
1940-
app.kubernetes.io/version: '3.4.0'
1940+
app.kubernetes.io/version: '3.4.1'
19411941
name: elasticsearches.elasticsearch.k8s.elastic.co
19421942
spec:
19431943
group: elasticsearch.k8s.elastic.co
@@ -3322,7 +3322,7 @@ metadata:
33223322
labels:
33233323
app.kubernetes.io/instance: 'elastic-operator'
33243324
app.kubernetes.io/name: 'eck-operator-crds'
3325-
app.kubernetes.io/version: '3.4.0'
3325+
app.kubernetes.io/version: '3.4.1'
33263326
name: enterprisesearches.enterprisesearch.k8s.elastic.co
33273327
spec:
33283328
group: enterprisesearch.k8s.elastic.co
@@ -3800,7 +3800,7 @@ metadata:
38003800
labels:
38013801
app.kubernetes.io/instance: 'elastic-operator'
38023802
app.kubernetes.io/name: 'eck-operator-crds'
3803-
app.kubernetes.io/version: '3.4.0'
3803+
app.kubernetes.io/version: '3.4.1'
38043804
name: kibanas.kibana.k8s.elastic.co
38053805
spec:
38063806
group: kibana.k8s.elastic.co
@@ -4368,7 +4368,7 @@ metadata:
43684368
labels:
43694369
app.kubernetes.io/instance: 'elastic-operator'
43704370
app.kubernetes.io/name: 'eck-operator-crds'
4371-
app.kubernetes.io/version: '3.4.0'
4371+
app.kubernetes.io/version: '3.4.1'
43724372
name: logstashes.logstash.k8s.elastic.co
43734373
spec:
43744374
group: logstash.k8s.elastic.co
@@ -4911,7 +4911,7 @@ metadata:
49114911
labels:
49124912
app.kubernetes.io/instance: 'elastic-operator'
49134913
app.kubernetes.io/name: 'eck-operator-crds'
4914-
app.kubernetes.io/version: '3.4.0'
4914+
app.kubernetes.io/version: '3.4.1'
49154915
name: packageregistries.packageregistry.k8s.elastic.co
49164916
spec:
49174917
group: packageregistry.k8s.elastic.co
@@ -5153,7 +5153,7 @@ metadata:
51535153
labels:
51545154
app.kubernetes.io/instance: 'elastic-operator'
51555155
app.kubernetes.io/name: 'eck-operator-crds'
5156-
app.kubernetes.io/version: '3.4.0'
5156+
app.kubernetes.io/version: '3.4.1'
51575157
name: stackconfigpolicies.stackconfigpolicy.k8s.elastic.co
51585158
spec:
51595159
group: stackconfigpolicy.k8s.elastic.co

‎renovate.json‎

Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,88 @@
1+
{
2+
"$schema": "https://docs.renovatebot.com/renovate-schema.json",
3+
"extends": ["config:recommended"],
4+
"rebaseWhen": "behind-base-branch",
5+
"dependencyDashboard": false,
6+
"baseBranchPatterns": ["release-v1.40", "release-v1.42", "release-v1.43", "master"],
7+
"prBodyTemplate": "{{{header}}}{{{table}}}{{{warnings}}}{{{notes}}}{{{changelogs}}}{{{controls}}}",
8+
"separateMinorPatch": true,
9+
"enabledManagers": ["gomod", "custom.regex"],
10+
"prHourlyLimit": 20,
11+
"prConcurrentLimit": 20,
12+
"addLabels": ["docs-not-required", "release-note-not-required", "dependencies"],
13+
"gomod": {
14+
"managerFilePatterns": ["/^go\\.mod$/"]
15+
},
16+
"vulnerabilityAlerts": {
17+
"enabled": true
18+
},
19+
"postUpdateOptions": ["gomodTidy"],
20+
"customManagers": [
21+
{
22+
"customType": "regex",
23+
"managerFilePatterns": ["/^go\\.mod$/"],
24+
"matchStrings": ["\\ngo (?<currentValue>\\d+\\.\\d+\\.\\d+)"],
25+
"depNameTemplate": "golang",
26+
"datasourceTemplate": "golang-version"
27+
},
28+
{
29+
"customType": "regex",
30+
"managerFilePatterns": ["/^Makefile$/"],
31+
"matchStrings": ["CALICO_BASE_VER\\s*\\??=\\s*(?<currentValue>ubi\\d+-\\d+)"],
32+
"depNameTemplate": "calico/base",
33+
"datasourceTemplate": "docker",
34+
"versioningTemplate": "regex:^(?<compatibility>ubi\\d+)-(?<patch>\\d+)$"
35+
},
36+
{
37+
"customType": "regex",
38+
"managerFilePatterns": ["/^Makefile$/"],
39+
"matchStrings": ["GO_VERSION\\s*\\??=\\s*(?<currentValue>\\d+\\.\\d+\\.\\d+)"],
40+
"depNameTemplate": "golang",
41+
"datasourceTemplate": "golang-version"
42+
},
43+
{
44+
"customType": "regex",
45+
"managerFilePatterns": ["/^Makefile$/"],
46+
"matchStrings": ["K8S_VERSION\\s*\\??=\\s*v(?<currentValue>\\d+\\.\\d+\\.\\d+)"],
47+
"depNameTemplate": "kubernetes/kubernetes",
48+
"datasourceTemplate": "github-releases",
49+
"extractVersionTemplate": "^v(?<version>.*)$"
50+
}
51+
],
52+
"packageRules": [
53+
{
54+
"description": "Disable all Go module updates",
55+
"matchManagers": ["gomod"],
56+
"enabled": false
57+
},
58+
{
59+
"description": "Enable k8s.io dependencies",
60+
"matchManagers": ["gomod"],
61+
"matchPackageNames": ["k8s.io/**"],
62+
"enabled": true
63+
},
64+
{
65+
"description": "Enable golang.org/x libraries",
66+
"matchManagers": ["gomod"],
67+
"matchPackageNames": ["golang.org/x/**"],
68+
"enabled": true
69+
},
70+
{
71+
"description": "Block all minor, major, and digest updates",
72+
"matchUpdateTypes": ["minor", "major", "digest"],
73+
"enabled": false
74+
},
75+
{
76+
"description": "Allow golang.org/x minor updates",
77+
"matchPackageNames": ["golang.org/x/**"],
78+
"matchUpdateTypes": ["minor"],
79+
"enabled": true
80+
},
81+
{
82+
"description": "Group all updates into one PR",
83+
"matchPackageNames": ["*"],
84+
"matchDepNames": ["*"],
85+
"groupName": "dependency-updates"
86+
}
87+
]
88+
}

0 commit comments

Comments
 (0)