Request to allow postUpgradeTasks for polarsquad/krops

[lmilbaum]

Repo

polarsquad/krops, on the hosted Mend/Renovate GitHub App.

What we're trying to do

We air-gap-package a Cluster API / kind stack, and pin the exact container images the cluster needs in airgap/images.txt. A subset of those pins (kube-apiserver, kube-controller-manager, kube-proxy, kube-scheduler, coredns, etcd, pause) aren't independent dependencies -- they have to match whatever the pinned kindest/node Kubernetes version's own kubeadm binary actually deploys (kubeadm config images list --kubernetes-version vX.Y.Z), which is not the same as "latest upstream tag" for each of those images individually. Background: polarsquad/krops#142.

Because we can't run postUpgradeTasks on the hosted App, Renovate has no way to fix these pins itself when it bumps kindest/node. The best we've been able to do is add a CI gate (test-airgap-kubeadm-images.py) that runs the real kubeadm binary and fails the PR before merge if the pins have drifted -- it catches the problem but doesn't fix it, so every kindest/node bump still needs a manual follow-up commit. We wrote up the tradeoff in docs/dependencies.md.

Ask

We noticed Mend has allowlisted postUpgradeTasks for individual repos/orgs on the hosted App before (e.g. cert-manager, riscv-unified-db), reviewing the actual script for safety rather than this being a hard platform limitation.

Would Mend consider the same for polarsquad/krops, scoped to executionMode: "branch", running a script that regenerates airgap/images.txt's k8s-component pins from kubeadm config images list right after a kindest/node bump? That would let the PR open already correct and let us retire the CI gate. Happy to share the exact script for review once we know this is feasible -- we held off writing it until we knew whether it could actually run.

[jamietanna]

Thanks for your interest, but at this time, we're not going to allowlist this configuration for your repository.

Either self-hosting Renovate, or keeping a check in your repository is a better option here to keep the files up-to-date

[lmilbaum]

Thanks Jamie! I really appreciate you taking the time to look into this and suggest alternatives. Totally understand, and we'll figure out the best way forward on our side. Thanks again!