Zenn
Open7

Renovate

Renovate
mikutasmikutas

スケジュール無視

更新対象リポジトリのrenovate.json5のスケジュール設定を無視するには--schedule=""（または単に--schedule=）を使う

特定のmanagerのみ

特定のmanagerだけ対象にするには--enabled-managers=regexみたいにする

mikutasmikutas

https://github.com/aws/aws-for-fluent-bit

values.yamlのイメージタグにstableと書かないでバージョン番号をはっきり書く
が、その番号をlatestではなくstableの範疇で更新させる

{
  "packageRules": [
    {
      "matchDepNames": ["public.ecr.aws/aws-observability/aws-for-fluent-bit"],
      "matchDatasources": ["docker"],
      "matchManagers": ["helm-values"],
      "enabled": false
    }
  ],
  "customManagers": [
    {
      "customType": "regex",
      "fileMatch": [
        "values\\.yaml"
      ],
      "matchStrings": [
        "public\\.ecr\\.aws\\/aws-observability\\/aws-for-fluent-bit:(?<currentValue>.*)"
      ],
      "datasourceTemplate": "custom.aws-for-fluent-bit-stable",
      "depNameTemplate": "public.ecr.aws/aws-observability/aws-for-fluent-bit"
    }
  ],
  "customDatasources": {
    "aws-for-fluent-bit-stable": {
      "defaultRegistryUrlTemplate": "https://raw.githubusercontent.com/aws/aws-for-fluent-bit/mainline/AWS_FOR_FLUENT_BIT_STABLE_VERSION",
      "format": "plain"
    }
  }
}

https://docs.renovatebot.com/modules/datasource/custom/

https://github.com/renovatebot/renovate/discussions/23286

mikutasmikutas

EKS AMIを更新

dataでrecommended（最新）を取って使っていたけどAMIリリースのタイミングによって本番で最初に新しいAMIが適用されたりしてdev->stg->prodの順を保証したかった

data "aws_ssm_parameter" "eks_ami_id" {
  # https://docs.aws.amazon.com/ja_jp/eks/latest/userguide/retrieve-ami-id.html
  name = "/aws/service/eks/optimized-ami/${var.cluster_version}/amazon-linux-2/recommended/image_id"
}

https://docs.renovatebot.com/modules/datasource/aws-machine-image/

  "customManagers": [
    {
      "customType": "regex",
      "fileMatch": [".*\\.tf"],
      "matchStrings":
        [
          ".*amiFilter=(?<packageName>.*?)\n(.*currentImageName=(?<currentDigest>.*?)\n)?(.*\n)?.*?(?<depName>[a-zA-Z0-9-_:]*)[ ]*?[:|=][ ]*?[\"|']?(?<currentValue>ami-[a-z0-9]{17})[\"|']?.*"
        ],
      "datasourceTemplate": "aws-machine-image",
      "versioningTemplate": "aws-machine-image"
    }
  ],

resource "aws_launch_template" "foo" {
  # amiFilter=[{"Name":"owner-alias","Values":["amazon"]},{"Name":"name","Values":["amazon-eks-node-1.27-*"]}]
  # currentImageName=amazon-eks-node-1.27-v20230816
  image_id = "ami-065345b6ba37b05b6"
}

image_idの値だけでなく、コメントのcurrentImageNameの方も更新してくれる（matchStringsに含まれてる）

amiFilterのデバッグはaws ec2 describe-imagesでやる

https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/describe-images.html

aws ec2 describe-images --filter '[{"Name":"owner-alias","Values":["amazon"]},{"Name":"name","Values":["amazon-eks-node-1.27-*"]}]'

=の左辺は引用符で囲わないこと

locals {
  ami_id = {
    # amiFilter=[{"Name":"owner-alias","Values":["amazon"]},{"Name":"name","Values":["amazon-eks-node-1.27-*"]}]
    # currentImageName=amazon-eks-node-1.27-v20230919
    AL2_x86_64 = "ami-09f97dd1c9e12a629"
    # amiFilter=[{"Name":"owner-alias","Values":["amazon"]},{"Name":"name","Values":["amazon-eks-arm64-node-1.27-*"]}]
    # currentImageName=amazon-eks-arm64-node-1.27-v20230919
    AL2_ARM_64 = "ami-0a929dabc0dfad09f"
  }
}

https://regex101.com/r/bpCeRq/1

mikutasmikutas

al2023 かつ x86_64 なイメージを探す
レスポンスのJSONからImageId Name Descriptionだけ抽出する

aws ec2 describe-images --filter '[{"Name":"owner-alias","Values":["amazon"]},{"Name":"name","Values":["amazon-eks-node-al2023-x86_64-standard-1.28-*"]}]' | jq -r '.Images[] | {ImageId, Name, Description}'

https://github.com/awslabs/amazon-eks-ami/releases

mikutasmikutas

AWS Load Balancer ControllerのIAMポリシーを自動更新

data "http" "aws_lbc_policy" {
  # renovate: datasource=github-releases depName=aws-load-balancer-controller packageName=kubernetes-sigs/aws-load-balancer-controller
  url = "https://raw.githubusercontent.com/kubernetes-sigs/aws-load-balancer-controller/v2.4.7/docs/install/iam_policy.json"
}

  "customManagers": [
    {
      "customType": "regex",
      "fileMatch": [
        "terraform\\/modules\\/irsa_aws_lbc\\/data\\.tf"
      ],
      "matchStrings": [
        "# renovate: datasource=(?<datasource>[a-z-]+?)(?: depName=(?<depName>.+?))? packageName=(?<packageName>.+?)?\\s.*kubernetes-sigs\\/aws-load-balancer-controller\\/(?<currentValue>.+?)\\/docs\\/install\\/iam_policy.json"
      ]
    }
  ]