Registry alias for Helm upgrades

[mihaigalos]

How are you running Renovate?

Self-hosted

If you're self-hosting Renovate, tell us what version of Renovate you run.

36.8.1

If you're self-hosting Renovate, select which platform you are using.

GitHub Enterprise Server

Was this something which used to work for you, and then stopped?

I never saw this working

Wanted end result.

We would like to automatically upgrade dependencies from upstream helm charts which contain fully-qualified image names.

From kyverno upstream chart, we expected the ghcr.io to be aliased to our internal container registry (Artifactory).

What you tried so far.

We tried setting registryAliases like in the following:

config.js:

module.exports = {
  hostRules: [
      {
        hostType: "docker",
        matchHost: "docker.artifacts.company.com",
        username: process.env.CONTAINER_REGISTRY_USER,
        password: process.env.CONTAINER_REGISTRY_TOKEN
      },
      {
        hostType: "helm",
        matchHost: "docker.artifacts.company.com",
        username: process.env.CONTAINER_REGISTRY_USER,
        password: process.env.CONTAINER_REGISTRY_TOKEN
      }
  ],
  packageRules: [{
    defaultRegistryUrls: ["docker.artifacts.company.com"],
    matchDatasources: ["helm", "docker"],
    registryUrls: ["docker.artifacts.company.com"],
    registryAliases: {
      "ghcr.io": "docker.artifacts.company.com"
    }
  }],
  regexManagers: [
    {
      fileMatch: [
        "deployment/Chart.yaml"
      ],
      matchStrings: [
        " +version: +(?<currentValue>[^'\" ]+) +# renovate: depName=(?<depName>[^ \\n]+) +(extractVersion=(?<extractVersion>[^\\n]+))?"
      ],
      depNameTemplate: "kyverno/kyverno",
      datasourceTemplate: "github-releases"
    }
  ]
}

renovate.json:

{
    "$schema": "https://docs.renovatebot.com/renovate-schema.json"
}

ci.yaml:

name: renovate

on:
  workflow_dispatch:
  push:
    paths:
    - .github/**

jobs:
  renovate:
    runs-on: my-runner
    steps:
    - name: Checkout Repository
      uses: actions/checkout@main

    - name: Validate renovate.json
      run: |
        set -xuoe pipefail
        docker run --rm -it \
          -v $PWD/.github/config.js:/usr/src/app/config.js \
          -v $PWD/.github/renovate.json:/usr/src/app/renovate.json \
          -e LOG_LEVEL=debug \
          -e CONTAINER_REGISTRY_USER=${{ secrets.CONTAINER_REGISTRY_USER }} \
          -e CONTAINER_REGISTRY_TOKEN=${{ secrets.CONTAINER_REGISTRY_TOKEN }} \
          -e RENOVATE_TOKEN=${{ secrets.RENOVATE_TOKEN }} \
          -e RENOVATE_ENDPOINT="https://code.company.com/api/v3/" \
          artifacts.company.com/foo-docker-host/foo-bar-renovate:616122-069607af75f5090c74b914b6ac32c9676d4c22d9 \
            renovate-config-validator

    - name: Renovate
      run: |
        set -xuoe pipefail
        docker run --rm -it \
          --net=host \
          -v $PWD/.github/config.js:/usr/src/app/config.js \
          -v $PWD/.github/renovate.json:/usr/src/app/renovate.json \
          -e LOG_LEVEL=debug \
          -e CONTAINER_REGISTRY_USER=${{ secrets.CONTAINER_REGISTRY_USER }} \
          -e CONTAINER_REGISTRY_TOKEN=${{ secrets.CONTAINER_REGISTRY_TOKEN }} \
          -e RENOVATE_TOKEN=${{ secrets.RENOVATE_TOKEN }} \
          -e RENOVATE_ENDPOINT="https://code.company.com/api/v3/" \
          artifacts.company.com/foo-docker-host/foo-bar-renovate:616122-069607af75f5090c74b914b6ac32c9676d4c22d9 \
            bash -c '\
              renovate \
                ${{ github.event.repository.full_name }}'

Relevant debug logs

Validation Logs

DEBUG: Using RE2 as regex engine
 INFO: Validating renovate.json
DEBUG: Checking for config file in /usr/src/app/config.js
 INFO: Validating config.js
 INFO: Config validated successfully

Run Logs

DEBUG: Dependency ghcr.io/kyverno/kyverno has unsupported/unversioned value undefined (versioning=docker) (repository=company_prefix/foo-test-kyverno-manifest)
DEBUG: Dependency ghcr.io/kyverno/kyvernopre has unsupported/unversioned value undefined (versioning=docker) (repository=company_prefix/foo-test-kyverno-manifest)
DEBUG: Dependency bitnami/kubectl has unsupported/unversioned value latest (versioning=docker) (repository=company_prefix/foo-test-kyverno-manifest)
DEBUG: Dependency ghcr.io/kyverno/cleanup-controller has unsupported/unversioned value undefined (versioning=docker) (repository=company_prefix/foo-test-kyverno-manifest)
DEBUG: Dependency artifacts.company.com/docker/bitnami/kubectl has unsupported/unversioned value latest (versioning=docker) (repository=company_prefix/foo-test-kyverno-manifest)
DEBUG: GET https://ghcr.io/v2/kyverno/policy-reporter-kyverno-plugin/tags/list?n=10000 = (code=EPROTO, statusCode=-1 retryCount=0, duration=28) (repository=company_prefix/foo-test-kyverno-manifest)
 WARN: Error obtaining docker token (repository=company_prefix/foo-test-kyverno-manifest)
       "registryHost": "https://ghcr.io",
       "dockerRepository": "kyverno/policy-reporter-kyverno-plugin",
       "err": {
         "name": "RequestError",
         "code": "EPROTO",
         "timings": {
           "start": 1689251542769,
           "socket": 1689251542769,
           "lookup": 1689251542774,
           "connect": 1689251542780,
           "upload": 1689251542797,
           "error": 1689251542797,
           "phases": {"wait": 0, "dns": 5, "tcp": 6, "request": 17, "total": 28}
         },
         "message": "write EPROTO C057EB8FD97F0000:error:0A000152:SSL routines:final_renegotiate:unsafe legacy renegotiation disabled:../deps/openssl/openssl/ssl/statem/extensions.c:922:\n",
         "stack": "RequestError: write EPROTO C057EB8FD97F0000:error:0A000152:SSL routines:final_renegotiate:unsafe legacy renegotiation disabled:../deps/openssl/openssl/ssl/statem/extensions.c:922:\n\n    at ClientRequest.<anonymous> (/opt/containerbase/tools/renovate/36.8.1/node_modules/got/dist/source/core/index.js:970:111)\n    at Object.onceWrapper (node:events:628:26)\n    at ClientRequest.emit (node:events:525:35)\n    at ClientRequest.emit (node:domain:489:12)\n    at ClientRequest.origin.emit (/opt/containerbase/tools/renovate/36.8.1/node_modules/@szmarczak/http-timer/dist/source/index.js:43:20)\n    at TLSSocket.socketErrorListener (node:_http_client:502:9)\n    at TLSSocket.emit (node:events:513:28)\n    at TLSSocket.emit (node:domain:489:12)\n    at emitErrorNT (node:internal/streams/destroy:151:8)\n    at emitErrorCloseNT (node:internal/streams/destroy:116:3)\n    at processTicksAndRejections (node:internal/process/task_queues:82:21)\n    at WriteWrap.onWriteComplete [as oncomplete] (node:internal/stream_base_commons:94:16)",
         "options": {
           "headers": {
             "user-agent": "RenovateBot/36.8.1 (https://github.com/renovatebot/renovate)",
             "accept": "application/json",
             "accept-encoding": "gzip, deflate, br"
           },
           "url": "https://ghcr.io/v2/kyverno/policy-reporter-kyverno-plugin/tags/list?n=10000",
           "hostType": "docker",
           "username": "",
           "password": "",
           "method": "GET",
           "http2": false
         }
       }

[viceice]

registry aliases is a top-level option, so don't use inside package rules

[mihaigalos]

Thanks for the reply. I've put it between packageRules and regexManagers, same outcome.

[mihaigalos]

I've found this comment from @rarkins:

The way registryUrls works today is that it applies only to short image names such as node or whitesource/renovate. Even that way it has to do some hacky try/fail/retry to check whether library/ needs prepending. It does not apply the registryUrls to fully qualified images like quay.io/foo/bar

Can you please confirm that this discussion is pertaining to the referenced issue? It looks like a feature request.

[mihaigalos]

Tried this (single renovate.json file):

{
    "packageRules": [
      {
        "matchDatasources": ["docker"],
        "matchPackagePatterns": ["^ghcr\\.io/.+$"],
        "replacementNameTemplate": "{{{replace 'ghcr\\.io/' 'docker.artifacts.company.com/' packageName}}}"
      }
    ]
}

Result:

            {
             "deps": [
               {
                 "depName": "ghcr.io/kyverno/policy-reporter-ui",
                 "currentValue": "1.7.2",
                 "datasource": "docker",
                 "replaceString": "1.7.2",
                 "versioning": "docker",
                 "autoReplaceStringTemplate": "{{newValue}}{{#if newDigest}}@{{newDigest}}{{/if}}",
                 "updates": [],
                 "packageName": "ghcr.io/kyverno/policy-reporter-ui",
                 "warnings": [
                   {
                     "topic": "ghcr.io/kyverno/policy-reporter-ui",
                     "message": "Failed to look up docker package ghcr.io/kyverno/policy-reporter-ui"
                   }
                 ]
               }
             ],
             "packageFile": "deployment/charts/policy-reporter/charts/ui/values.yaml"
           },