Renovate

Renovate proposes dependency updates in Git repositories. Big Bang deploys the self-hosted Renovate chart as a CronJob; it creates branches and merge or pull requests in the configured Git service, but does not deploy changes to a cluster. Normal repository review, testing, approval, and GitOps reconciliation determine whether a proposed update reaches an environment.

Big Bang integration

At the pinned Big Bang revision, Renovate is a generic package. Enable it with packages.renovate when packageConfiguration.version: v1 is set. For the legacy Big Bang 3.x package contract, use the renovate key. With v1, the canonical packages.renovate values take precedence over legacy renovate values when both are provided.

Renovate is disabled by default. The umbrella package configuration selects the package source and chart version, creates the renovate namespace, and passes values to this chart. The package keeps stable renovate nameOverride and fullnameOverride values because the CronJob, configuration Secret, policies, and test fixture select that name.

packageConfiguration:
  version: v1
packages:
  renovate:
    enabled: true
    values:
      upstream:
        renovate:
          configIsSecret: true
          configIsJson5: true
          config: "{}"

upstream is the passthrough entry point for the bundled Renovate chart. Use the versioned upstream chart values for its complete configuration surface rather than copying nested upstream settings into Big Bang values.

Configuration and credentials

The upstream chart writes upstream.renovate.config to a configuration Secret when configIsSecret is enabled, which is the package default. Supply production Git-service tokens and any registry credentials through an existing Secret or other Secret-backed configuration mechanism; do not place real tokens or passwords in values files, examples, logs, or merge requests. Grant the token only the repository and API permissions Renovate needs.

These package values wire an existing credentials Secret into the CronJob and constrain an initial GitLab test to one repository:

upstream:
  existingSecret: renovate-credentials
  renovate:
    configIsSecret: true
    configIsJson5: true
    config: |
      {
        "platform": "gitlab",
        "endpoint": "https://gitlab.example.com/api/v4",
        "autodiscover": false,
        "repositories": ["sandbox/dependency-test"],
        "dryRun": "full"
      }

Provision renovate-credentials in the Renovate namespace through your secret manager with key RENOVATE_TOKEN. The locked chart exposes Secret keys as environment variables; include only intended variables and avoid conflicting platform, repository, or dry-run overrides. The Secret reference is under upstream.existingSecret, not upstream.renovate.existingSecret, and is distinct from an existing configuration-file reference. Replace the endpoint/repository with an approved sandbox and retain any other required configuration when replacing the config string. This still performs authenticated network reads; do not run the deployed package fixture against this Git service or print the resolved configuration/token in troubleshooting evidence.

The Renovate configuration controls the Git platform, API endpoint, repository scope or autodiscovery, schedules, and dry-run behavior. Test against a non-production repository first. A dry run is useful for confirming repository selection and proposed updates, but it is still allowed to query the configured Git service and dependency sources. Before a non-dry-run execution, confirm the endpoint, repository scope, and token permissions because Renovate can create branches and merge or pull requests.

For configuration syntax and behavior, use the Renovate self-hosted configuration documentation and configuration options reference.

Network and mesh behavior

The package uses bb-common to render NetworkPolicies and, when enabled, Istio policy resources. NetworkPolicy is enabled by default and permits Renovate HTTPS egress so it can reach Git services, registries, and package hosts; DNS is also required. Restricting that access requires validating every configured datasource and Git endpoint, including mesh behavior.

When the chart’s Istio settings are enabled, bb-common renders the package mesh resources. The package does not expose an ingress service for Renovate’s normal CronJob operation. See the bb-common integration guide for the Big Bang mesh and policy contract.

Operations and validation

The chart runs Renovate on the configured CronJob schedule. Operators can use Kubernetes job and pod status and logs to investigate a run, while taking care not to disclose configuration Secret contents or tokens.

The package’s chart test uses an ephemeral hardened Gitea fixture. It provisions test repositories and a short-lived test token, updates the deployed test configuration Secret, runs a Job from the Renovate CronJob, and verifies an update proposal. The fixture supports strict and permissive mesh variants. It is a disposable-cluster test only; it must not be used with production Git services or credentials.

See the package chart and release history, the Big Bang values reference, and the upstream Renovate documentation for further details.