feat(manager/kubernetes): extract image volume references from manifests (renovatebot#42038)

* feat(manager/kubernetes): extract image volume references from manifests

* fix coverage

* review comments

* simplify

Author: Churro

lib/modules/manager/kubernetes/extract.spec.ts

@@ -1,3 +1,4 @@
+import { codeBlock } from 'common-tags';
 import { Fixtures } from '~test/fixtures.ts';
 import { extractPackageFile } from './index.ts';
 
@@ -217,5 +218,167 @@ kind: ConfigMap
         ],
       });
     });
+
+    describe('image volume references', () => {
+      it.each`
+        kind                       | apiVersion
+        ${'DaemonSet'}             | ${'apps/v1'}
+        ${'Deployment'}            | ${'apps/v1'}
+        ${'Job'}                   | ${'batch/v1'}
+        ${'ReplicaSet'}            | ${'apps/v1'}
+        ${'ReplicationController'} | ${'v1'}
+        ${'StatefulSet'}           | ${'apps/v1'}
+      `(
+        'extracts image volumes from $kind',
+        ({ kind, apiVersion }: { kind: string; apiVersion: string }) => {
+          const res = extractPackageFile(
+            codeBlock`
+              apiVersion: ${apiVersion}
+              kind: ${kind}
+              metadata:
+                name: test
+              spec:
+                template:
+                  spec:
+                    volumes:
+                      - name: vol
+                        image:
+                          reference: quay.io/test/image:v1.0.0
+            `,
+            'file.yaml',
+            {},
+          );
+
+          expect(res?.deps).toContainEqual({
+            autoReplaceStringTemplate:
+              '{{depName}}{{#if newValue}}:{{newValue}}{{/if}}{{#if newDigest}}@{{newDigest}}{{/if}}',
+            currentDigest: undefined,
+            currentValue: 'v1.0.0',
+            datasource: 'docker',
+            depName: 'quay.io/test/image',
+            packageName: 'quay.io/test/image',
+            replaceString: 'quay.io/test/image:v1.0.0',
+          });
+        },
+      );
+
+      it('extracts image volumes from Pod and CronJob', () => {
+        const res = extractPackageFile(
+          codeBlock`
+            apiVersion: v1
+            kind: Pod
+            metadata:
+              name: pod-test
+            spec:
+              volumes:
+                - name: vol
+                  image:
+                    reference: quay.io/test/pod-image:v1.0.0
+            ---
+            apiVersion: batch/v1
+            kind: CronJob
+            metadata:
+              name: cronjob-test
+            spec:
+              jobTemplate:
+                spec:
+                  template:
+                    spec:
+                      volumes:
+                        - name: vol
+                          image:
+                            reference: quay.io/test/cronjob-image:v2.0.0
+          `,
+          'file.yaml',
+          {},
+        );
+
+        expect(res?.deps).toStrictEqual([
+          {
+            autoReplaceStringTemplate:
+              '{{depName}}{{#if newValue}}:{{newValue}}{{/if}}{{#if newDigest}}@{{newDigest}}{{/if}}',
+            currentDigest: undefined,
+            currentValue: 'v1.0.0',
+            datasource: 'docker',
+            depName: 'quay.io/test/pod-image',
+            packageName: 'quay.io/test/pod-image',
+            replaceString: 'quay.io/test/pod-image:v1.0.0',
+          },
+          {
+            autoReplaceStringTemplate:
+              '{{depName}}{{#if newValue}}:{{newValue}}{{/if}}{{#if newDigest}}@{{newDigest}}{{/if}}',
+            currentDigest: undefined,
+            currentValue: 'v2.0.0',
+            datasource: 'docker',
+            depName: 'quay.io/test/cronjob-image',
+            packageName: 'quay.io/test/cronjob-image',
+            replaceString: 'quay.io/test/cronjob-image:v2.0.0',
+          },
+          {
+            currentValue: 'batch/v1',
+            datasource: 'kubernetes-api',
+            depName: 'CronJob',
+            versioning: 'kubernetes-api',
+          },
+        ]);
+      });
+
+      it('does not extract image volumes for unsupported kind', () => {
+        const res = extractPackageFile(
+          codeBlock`
+            apiVersion: extensions/v1beta1
+            kind: NetworkPolicy
+            metadata:
+              name: test-network-policy
+            spec:
+              podSelector: {}
+          `,
+          'file.yaml',
+          {},
+        );
+        expect(res?.deps).toStrictEqual([
+          {
+            currentValue: 'extensions/v1beta1',
+            datasource: 'kubernetes-api',
+            depName: 'NetworkPolicy',
+            versioning: 'kubernetes-api',
+          },
+        ]);
+      });
+
+      it('skips malformed volume entries and extracts valid ones', () => {
+        const res = extractPackageFile(
+          codeBlock`
+            apiVersion: v1
+            kind: Pod
+            metadata:
+              name: pod-test
+            spec:
+              volumes:
+                - name: bad-vol
+                  image:
+                    notReference: invalid
+                - name: good-vol
+                  image:
+                    reference: quay.io/test/image:v1.0.0
+          `,
+          'file.yaml',
+          {},
+        );
+
+        expect(res?.deps).toStrictEqual([
+          {
+            autoReplaceStringTemplate:
+              '{{depName}}{{#if newValue}}:{{newValue}}{{/if}}{{#if newDigest}}@{{newDigest}}{{/if}}',
+            currentDigest: undefined,
+            currentValue: 'v1.0.0',
+            datasource: 'docker',
+            depName: 'quay.io/test/image',
+            packageName: 'quay.io/test/image',
+            replaceString: 'quay.io/test/image:v1.0.0',
+          },
+        ]);
+      });
+    });
   });
 });

lib/modules/manager/kubernetes/extract.ts

@@ -34,6 +34,7 @@ export function extractPackageFile(
 
   const deps: PackageDependency[] = [
     ...extractImages(content, config),
+    ...extractImageVolumes(manifests, config),
     ...extractApis(manifests),
   ];
 
@@ -74,6 +75,30 @@ function extractImages(
   return deps;
 }
 
+function extractImageVolumes(
+  manifests: KubernetesManifest[],
+  config: ExtractConfig,
+): PackageDependency[] {
+  const deps: PackageDependency[] = [];
+
+  for (const manifest of manifests) {
+    for (const currentFrom of manifest.imageVolumeReferences) {
+      const dep = getDep(currentFrom, true, config.registryAliases);
+      logger.debug(
+        {
+          depName: dep.depName,
+          currentValue: dep.currentValue,
+          currentDigest: dep.currentDigest,
+        },
+        'Kubernetes image volume',
+      );
+      deps.push(dep);
+    }
+  }
+
+  return deps;
+}
+
 function extractApis(manifests: KubernetesManifest[]): PackageDependency[] {
   return manifests
     .filter((m) => supportedApis.has(m.kind))

lib/modules/manager/kubernetes/schema.ts

@@ -1,6 +1,43 @@
 import { z } from 'zod/v3';
 import { LooseArray, multidocYaml } from '../../../util/schema-utils/index.ts';
 
+const PodSpecVolumes = z.object({
+  volumes: LooseArray(z.object({ image: z.object({ reference: z.string() }) }))
+    .transform((volumes) => volumes.map((v) => v.image.reference))
+    .catch([]),
+});
+
+const TemplateSpecVolumes = z.object({
+  template: z.object({ spec: PodSpecVolumes }),
+});
+
+const ImageVolumeReferences = z
+  .discriminatedUnion('kind', [
+    z.object({
+      kind: z.literal('Pod'),
+      spec: PodSpecVolumes.transform((s) => s.volumes),
+    }),
+    z.object({
+      kind: z.enum([
+        'DaemonSet',
+        'Deployment',
+        'Job',
+        'ReplicaSet',
+        'ReplicationController',
+        'StatefulSet',
+      ]),
+      spec: TemplateSpecVolumes.transform((s) => s.template.spec.volumes),
+    }),
+    z.object({
+      kind: z.literal('CronJob'),
+      spec: z
+        .object({ jobTemplate: z.object({ spec: TemplateSpecVolumes }) })
+        .transform((s) => s.jobTemplate.spec.template.spec.volumes),
+    }),
+  ])
+  .transform(({ spec }) => spec)
+  .catch([]);
+
 export const KubernetesResource = z.object({
   apiVersion: z.string().trim().min(1),
   kind: z.string().trim().min(1),
@@ -10,8 +47,17 @@ export const KubernetesResource = z.object({
   }),
 });
 
-export type KubernetesManifest = z.infer<typeof KubernetesResource>;
+export const KubernetesManifest = KubernetesResource.extend({
+  spec: z.unknown(),
+}).transform(({ spec, ...resource }) => ({
+  ...resource,
+  imageVolumeReferences: ImageVolumeReferences.parse({
+    kind: resource.kind,
+    spec,
+  }),
+}));
+export type KubernetesManifest = z.infer<typeof KubernetesManifest>;
 
 export const KubernetesManifests = multidocYaml({
   removeTemplates: true,
-}).pipe(LooseArray(KubernetesResource));
+}).pipe(LooseArray(KubernetesManifest));