How to add a deployment to Renovate¶

This guide shows you how to bring a CDK8S deployment under Renovate management, so that upstream chart or image releases arrive as ready-to-merge merge requests with regenerated manifests.

The example uses a deployment named myapp in dp-infra; adjust the path for dp-kup.

Annotate the version lines¶

Add a # renovate: comment directly above each pinned version in the deployment’s config.yaml:

versions:
  # renovate: datasource=docker depName=myorg/myapp
  myapp: "1.2.3"

For a Helm chart, add the chart repository:

# renovate: datasource=helm registryUrl=https://charts.example.com depName=myapp
chartVersion: "1.2.3"

Refer to Renovate configuration reference for the full annotation syntax.

Make the deployment build hermetically¶

Renovate builds the deployment in a clean checkout, so the repository must contain everything the build needs.

Remove imports/ from the deployment’s .gitignore, then force-add the generated imports:
```
git add -f myapp/imports/*.ts
```
Confirm cdk8s-cli is a dependency in myapp/package.json. Add it if it is missing.
Confirm the lockfile (package-lock.json or pnpm-lock.yaml) is committed.

Add a package rule¶

Add a package rule to the repository’s renovate.json that regenerates the manifests after a bump:

{
  "matchFileNames": ["myapp/**"],
  "groupName": "myapp",
  "postUpgradeTasks": {
    "commands": ["sh -c 'cd myapp && npm ci && npm run build'"],
    "fileFilters": ["myapp/manifests/**", "myapp/package-lock.json"],
    "executionMode": "branch"
  }
}

Use pnpm install --frozen-lockfile in place of npm ci for a pnpm deployment.

Important

Keep the command wrapped in sh -c '...' and make sure it matches an allowedCommands entry in the global config.js. A command that does not match is rejected, and the manifests are not regenerated.

Verify¶

Commit and push the annotation, imports, and renovate.json change to main.
Trigger a manual run — see How to operate Renovate.
Open the resulting merge request and confirm its diff includes myapp/manifests/, not only config.yaml.

A merge request that changes only config.yaml means the build step failed; check the run logs before merging.