Skip to content

Renovate (dependency updates)

Dependency bumps — Helm charts and container images — are proposed automatically by Renovate, which opens and updates pull requests against each GitOps repo. Humans review and merge; nothing lands unattended except an explicit allowlist.

How it runs

A renovate CronJob in the platform-shared namespace runs daily. It reads each repo's renovate.json and opens/refreshes PRs. To run it on demand:

kubectl create job --from=cronjob/renovate renovate-manual -n platform-shared

Per-repo config (renovate.json)

  • customManagers match specific file paths to catch versions Helm's own detection misses — e.g. a container image tag pinned in a values.yaml. A new applications/<app>/ that pins such a tag needs its own customManager entry, or Renovate won't track it.
  • packageRules control grouping, scheduling, and automerge policy.

Reading a Renovate PR

  • Cooldown / stability-days: a new release can be held for a stability window before it's eligible to merge. While it's held, treat it as do not merge — wait for the window to clear.
  • Automerge is opt-in per repo via an allowlist and is never applied to Helm chart bumps — those always get a human review.

Merge discipline

  • Bump one load-bearing dependency at a time; when something is deployed to all three ArgoCD instances, canary the least-critical one first and verify before the rest.
  • After merging, let ArgoCD sync — or trigger it yourself (see Operations).

See also: Architecture · Operations · Sealed Secrets.