../../_images/kup6s-icon-deployment.svg

Renovate

Self-hosted Renovate bot that watches upstream releases and opens merge requests to bump pinned versions in the GitOps repositories. It runs as a nightly Kubernetes CronJob against git.bluedynamics.eu and covers kup6s/dp/dp-kup and kup6s/dp/dp-infra.

Overview

Renovate detects new upstream versions, opens a merge request per update, and assigns it to a maintainer. For CDK8S deployments it also regenerates the Kubernetes manifests inside the same merge request, so that a merge is a deploy.

Component

Implementation

Runner

CronJob renovate in namespace renovate, image renovate/renovate:*-full, nightly at 01:23 Europe/Vienna

Platform auth

GitLab group access token (bot user, api scope, Developer on group kup6s/dp), delivered via ESO

Global config

ConfigMap renovate-config (config.js) — platform, repositories, allowedCommands, git author

Per-repo config

renovate.json at the root of dp-kup and dp-infra

Deployment

CDK8S in dp-infra/renovate/, ArgoCD application renovate-app-c8be48c9

Alerting

RenovateRunStale PrometheusRule (>36h without a successful run) plus the stock KubeJobFailed

How an update flows

  1. The nightly run extracts dependencies from both repositories.

  2. For a pinned chart or image version, a comment annotation tells Renovate where to look upstream.

  3. Renovate opens a merge request that bumps the version and, for CDK8S deployments, runs a postUpgradeTasks build to regenerate the committed manifests.

  4. The bot assigns the merge request to the maintainer, who receives a GitLab email.

  5. Merging to main triggers the normal ArgoCD auto-sync — the merge is the deploy.

Renovate never merges on its own. A human reviews every merge request, which is the control point for a live cluster.

See also

Design and rollout are recorded in docs/superpowers/specs/2026-07-26-renovate-kup6s-design.md.

Scope

The comment-annotation manager and manifest regeneration are wired for OpenProject (dp-kup) and for Plausible, Solidtime, and Renovate itself (dp-infra). The standard managers (npm, Dockerfile, Helm) run across both repositories without extra configuration and open review-only merge requests for everything else.

Rollout to the helix clusters is a later stage and is out of scope here.

Table of contents