add devenv

.github/workflows/renovate.yml

@@ -0,0 +1,43 @@
+name: Renovate
+
+on:
+  workflow_dispatch:
+    inputs:
+      dryRun:
+        description: Dry run
+        type: boolean
+        default: false
+        required: true
+      logLevel:
+        description: Log level
+        type: choice
+        default: info
+        options:
+          - info
+          - debug
+        required: true
+  push:
+    branches:
+      - main
+    paths:
+      - .renovate/**.json
+  schedule:
+    - cron: 0 * * * *
+
+jobs:
+  renovate:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5.0.0
+      - name: Run renovate
+        uses: renovatebot/github-action@v43.0.18
+        env:
+          LOG_LEVEL: ${{ inputs.logLevel || 'info' }}
+          RENOVATE_DRY_RUN: ${{ inputs.dryRun }}
+          RENOVATE_ONBOARDING: false
+          RENOVATE_REPOSITORIES: ${{ github.repository }}
+          RENOVATE_REQUIRE_CONFIG: optional
+        with:
+          configurationFile: .renovate/config.json
+          token: ${{ secrets.RENOVATE_TOKEN }}

.renovate/commit-message.json

@@ -0,0 +1,25 @@
+{
+  "commitMessageTopic": "{{depName}}",
+  "commitMessageExtra": "to {{newVersion}}",
+  "packageRules": [
+    {
+      "matchPackagePatterns": ["*"],
+      "semanticCommitType": "build"
+    },
+    {
+      "matchDatasources": ["docker"],
+      "semanticCommitScope": "docker",
+      "commitMessageTopic": "{{{replace '.+/' '' depName}}}"
+    },
+    {
+      "matchDatasources": ["github-actions", "github-releases", "github-tags"],
+      "semanticCommitScope": "github",
+      "commitMessageTopic": "{{depName}}"
+    },
+    {
+      "matchDatasources": ["helm"],
+      "semanticCommitScope": "helm",
+      "commitMessageTopic": "{{depName}}"
+    }
+  ]
+}

.renovate/config.json

@@ -0,0 +1,13 @@
+{
+  "extends": [
+    "config:recommended",
+    "docker:enableMajor",
+    ":disableRateLimiting",
+    ":disableDependencyDashboard",
+    ":semanticCommits",
+    "github>ocf/kubernetes//.renovate/commit-message",
+    "github>ocf/kubernetes//.renovate/manager",
+    "github>ocf/kubernetes//.renovate/pr-label"
+  ],
+  "prBodyTemplate": "{{{table}}}{{{notes}}}{{{changelogs}}}{{{controls}}}"
+}

.renovate/manager.json

@@ -0,0 +1,42 @@
+{
+  "customManagers": [
+    {
+      "customType": "regex",
+      "description": "Process comments",
+      "managerFilePatterns": ["/^apps/.+\\.py$/"],
+      "matchStrings": [
+        "# renovate source=(?<datasource>\\S+) name=(?<depName>\\S+)\n[^\n]+:\\s*\"(?<currentValue>[^:\"]+)\"",
+        "# renovate source=(?<datasource>\\S+) name=(?<depName>\\S+)\n[^\n]+:\\s*\"\\S+:(?<currentValue>[^:\"]+)\""
+      ]
+    },
+    {
+      "customType": "regex",
+      "description": "Process helm in version.toml",
+      "managerFilePatterns": ["/^apps/versions\\.toml$/"],
+      "matchStrings": [
+        "\\[(?<depName>[^\\]]+)\\]\nversion\\s*=\\s*\"(?<currentValue>[^\"]+)\"\nhelm\\s*=\\s*\"(?<registryUrl>http[^\"]+)\"(?:\n\n|\n$|$)",
+        "\\[[^\\]]+\\]\nversion\\s*=\\s*\"(?<currentValue>[^\"]+)\"\nhelm\\s*=\\s*\"(?<registryUrl>http[^\"]+)\"\nchart\\s*=\\s*\"(?<depName>[^\"]+)\""
+      ],
+      "datasourceTemplate": "helm"
+    },
+    {
+      "customType": "regex",
+      "description": "Process docker in version.toml",
+      "managerFilePatterns": ["/^apps/versions\\.toml$/"],
+      "matchStrings": [
+        "\\[[^\\]]+\\]\nversion\\s*=\\s*\"(?<currentValue>[^\"]+)\"\nhelm\\s*=\\s*\"oci://(?<depName>[^\"]+)\""
+      ],
+      "datasourceTemplate": "docker"
+    },
+    {
+      "customType": "regex",
+      "description": "Process github in version.toml",
+      "managerFilePatterns": ["/^apps/versions\\.toml$/"],
+      "matchStrings": [
+        "\\[[^\\]]+\\]\nversion\\s*=\\s*\"(?<currentValue>[^\"]+)\"\ngithub\\s*=\\s*\"https:\\/\\/github.com\\/(?<depName>[^\\/]+\/[^\\/\"\\.]+)[^\"]*\"",
+        "\\[[^\\]]+\\]\nversion\\s*=\\s*\"(?<currentValue>[^\"]+)\"\nrepo_url\\s*=\\s*\"https:\\/\\/github.com\\/(?<depName>[^\\/]+\/[^\\/\"\\.]+)[^\"]*\""
+      ],
+      "datasourceTemplate": "github-releases"
+    }
+  ]
+}

.renovate/pr-label.json

@@ -0,0 +1,28 @@
+{
+  "packageRules": [
+    {
+      "matchUpdateTypes": ["major"],
+      "addLabels": ["version/major"]
+    },
+    {
+      "matchUpdateTypes": ["minor"],
+      "addLabels": ["version/minor"]
+    },
+    {
+      "matchUpdateTypes": ["patch"],
+      "addLabels": ["version/patch"]
+    },
+    {
+      "matchDatasources": ["docker"],
+      "addLabels": ["renovate/docker"]
+    },
+    {
+      "matchDatasources": ["github-actions", "github-releases", "github-tags"],
+      "addLabels": ["renovate/github"]
+    },
+    {
+      "matchDatasources": ["helm"],
+      "addLabels": ["renovate/helm"]
+    }
+  ]
+}

apps/keycloak.py

@@ -266,7 +266,7 @@ def oidc_client(
                     "changedSyncPeriod": ["86400"],
                     "allowKerberosAuthentication": ["true"],
                     "kerberosRealm": ["OCF.BERKELEY.EDU"],
-                    "serverPrincipal": ["HTTP/lb-81.ocf.berkeley.edu@OCF.BERKELEY.EDU"],
+                    "serverPrincipal": ["HTTP/idm.ocf.berkeley.edu@OCF.BERKELEY.EDU"],
                     "keyTab": ["/vault/secrets/keytab"],
                     "debug": ["true"],
                     "useKerberosForPasswordAuthentication": ["true"],

apps/rook.py

@@ -3,9 +3,6 @@
 
 name = "rook"
 values = {
-    "image": {
-        "tag": "v1.17.7",
-    },
     # <https://rook.io/docs/rook/v1.10/CRDs/Cluster/ceph-cluster-crd/?h=stack#network-configuration-settings>
     "network": {
         "dualStack": True,
@@ -77,7 +74,10 @@ def objects():
             "annotations": {"argocd.argoproj.io/compare-options": "IgnoreExtraneous"},
         },
         "spec": {
-            "cephVersion": {"image": "quay.io/ceph/ceph:v19.2.3"},
+            "cephVersion": {
+                # renovate source=docker name=quay.io/ceph/ceph
+                "image": "quay.io/ceph/ceph:v19.2.3"
+            },
             "dataDirHostPath": "/var/lib/rook",
             "mon": {"count": 3, "allowMultiplePerNode": False},
             # Re-enable this when the issue that blocks it is merged and available in a released Ceph version.

apps/velero.py

@@ -8,6 +8,7 @@
     "initContainers": [
         {
             "name": "velero-plugin-for-csi",
+            # renovate source=docker name=docker.io/velero/velero-plugin-for-csi
             "image": "velero/velero-plugin-for-csi:v0.7.0",
             "imagePullPolicy": "IfNotPresent",
             "volumeMounts": [
@@ -20,6 +21,7 @@
         {
             "name": "velero-plugin-for-aws",
             # for S3-compatible API
+            # renovate source=docker name=docker.io/velero/velero-plugin-for-aws
             "image": "velero/velero-plugin-for-aws:v1.9.0",
             "imagePullPolicy": "IfNotPresent",
             "volumeMounts": [