Renovator fixes

CHANGELOG.md

@@ -4,6 +4,7 @@
 ### Added
 
 ### Changed
+- Renovate: Improve cert permissions and add instructions on APP_DNS
 - Updated the Renovate quickstarter to Renovate 44.133.0 and Helm chart 46.337.0, with grouped Docker image and chart self-updates ([#1173](https://github.com/opendevstack/ods-quickstarters/pull/1173))
 
 ### Fixed

renovate/Dockerfile.template

@@ -12,14 +12,12 @@ COPY import-certs.sh /usr/local/bin/import-certs.sh
 RUN chmod +x /usr/local/bin/import-certs.sh
 
 # Required for import-certs.sh and update-ca-certificates to work at runtime
-# Recursive only on /usr/local/share/ca-certificates (needs to write cert files there).
-# /etc/ssl/certs and /etc/ca-certificates.conf: directory/file ownership only — existing
-# system cert files stay root-owned, limiting write surface if container is compromised.
-# ca-certificates.crt is the bundle output file rewritten by update-ca-certificates — must be writable.
-RUN chown -R 12021 /usr/local/share/ca-certificates \
-    && chown 12021 /etc/ssl/certs \
-    && chown 12021 /etc/ssl/certs/ca-certificates.crt \
-    && chown 12021 /etc/ca-certificates.conf
+# Allow the configured user and OpenShift-assigned UIDs (which use group 0)
+# to import certificates and update the system trust store.
+RUN chown -R 12021:0 /usr/local/share/ca-certificates \
+    && chmod -R g=u /usr/local/share/ca-certificates \
+    && chown 12021:0 /etc/ssl/certs /etc/ssl/certs/ca-certificates.crt /etc/ca-certificates.conf \
+    && chmod g=u /etc/ssl/certs /etc/ssl/certs/ca-certificates.crt /etc/ca-certificates.conf
 
 # This is required because Node.js doesn't use the system CA store by default
 ENV NODE_EXTRA_CA_CERTS=/etc/ssl/certs/ca-certificates.crt    

renovate/Jenkinsfile.template

@@ -14,6 +14,7 @@ odsComponentPipeline(
   odsComponentStageScanWithSonar(context)
 
   odsComponentStageRolloutOpenShiftDeployment(context, [
+    helmValuesFiles: ['values.yaml', 'values.yaml.secret'],
     helmValues: [
       "renovate.image.repository": "${context.projectId}-cd/renovate",
       "renovate.image.tag": "${context.shortGitCommit}"

renovate/files/README.md

@@ -18,8 +18,11 @@ Check out the [Renovate documentation](https://docs.renovatebot.com/) for more i
 1. Modify the `configmap.yaml` file to customize the Renovate configuration for your project
 2. Supply the necessary credentials
    1. Configure your preferred way of specifying credentials (e.g. Helm Secrets or repository secrets with Transcrypt)
-   2. (Recommended) For GitHub, create a personal access token to fetch changelogs of dependencies
-   3. (Optional) For Nexus, create a token to access special packages
+   2. Configure APP_DNS in values.yaml (uncomment and insert your values)
+   3. (Recommended) For GitHub, create a personal access token to fetch changelogs of dependencies => add it to the encrypted `values.yaml.secret` file.
+   4. (Optional) For Nexus, create a token to access special packages => follow the example of the GITHUB_TOKEN
+
+The container imports certificates for the Bitbucket endpoint and the private Docker registry from `APP_DNS` (configured in `chart/values.yaml`). If your environment uses a private CA, prefer installing the CA certificate itself into the container's trust store rather than relying on certificates fetched from a live endpoint.
 
 ## Recommended Configuration Options
 

renovate/files/chart/templates/configmap.yaml

@@ -28,6 +28,10 @@ data:
           "mergeConfidence:all-badges"
         ],
         "hostRules": [
+          {
+            "hostType": "docker",
+            "allowInternal": true
+          },
           {
             "hostType": "github",
             "token": process.env.GITHUB_TOKEN

renovate/files/chart/values.yaml

@@ -19,6 +19,9 @@ renovate:
 
   # -- Additional env. Helpful too if you want to use anything other than a `value` source.
   envList:
+    # UNCOMMENT BELOW AND REPLACE, e.g. bitbucket.example.com;docker-group-ods.example.com
+    # - name: APP_DNS
+    #   value: "<your-bitbucket-url>:443;<your-docker-registry-host>:443"
     - name: CD_USERNAME
       valueFrom:
         secretKeyRef: