Running Renovate in Kubernetes with GitOps

Running Renovate in Kubernetes with GitOps

In this post, you’ll learn how to deploy Renovate Bot in Kubernetes to scan your FluxCD manifests and HelmRelease resources, detect new Docker image tags and Helm chart versions, and automatically create Pull Requests in your GitOps repository.

---

✅ Why Renovate?

Renovate is an open-source tool for automated dependency management. In a GitOps environment, it enables:

• Detecting new container image versions in your deployments.
• Updating Helm charts defined in Flux manifests (HelmRelease).
• Creating pull requests with changes and a Dependency Dashboard.

---

🚀 Installing in Kubernetes with Helm

Renovate provides an official Helm chart. You can run it as a CronJob to perform daily scans.

First, create the HelmRepository for Renovate:

apiVersion: source.toolkit.fluxcd.io/v1
kind: HelmRepository
metadata:
  name: renovate
  namespace: monitoring
spec:
  interval: 1h
  url: https://renovatebot.github.io/helm-charts

Then here’s the Renovate HelmRelease. This example targets a GitHub repo, so you’ll need a GitHub token, stored in the renovate-secret secret under the RENOVATE_TOKEN key. You can also enable Redis and a persistence volume as cache. Set your own user/repo under "repositories": ["YourUser/YourRepo"].

apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
  name: renovate
  namespace: monitoring
spec:
  interval: 1h
  chart:
    spec:
      chart: renovate
      version: 41.37.4
      sourceRef:
        kind: HelmRepository
        name: renovate
  values:
    cronjob:
      schedule: "0 3 * * *" # Runs daily at 03:00 AM
    redis:
      enabled: true        
    envFrom:
      - secretRef:
          name: renovate-secret # Contains RENOVATE_TOKEN
    renovate:
      config: |
        {
          "$schema": "https://docs.renovatebot.com/renovate-schema.json",
          "platform": "github",
          "token": "${RENOVATE_TOKEN}",
          "repositories": ["YourUser/YourRepo"],
          "extends": ["config:recommended"],
          "enabledManagers": ["kubernetes", "flux"],
          "flux": {
            "fileMatch": ["cluster/.+\\.ya?ml$"]
          },
          "kubernetes": {
            "fileMatch": ["cluster/.+\\.ya?ml$"]
          },
          "dependencyDashboard": true,
          "branchConcurrentLimit": 5,
          "prConcurrentLimit": 5,
          "baseBranchPatterns": ["master"],
          "automerge": false
        }
    persistence:
      cache:
        enabled: true
        storageClass: "longhorn"
        storageSize: "512Mi"

The first run creates a single PR against your repo — the Dependency Dashboard — which you need to accept before Renovate will start scanning and opening real update PRs.

---

🧩 Native Flux support

Instead of relying on complex regex rules, Renovate supports Flux natively via "enabledManagers": ["kubernetes", "flux"]. This lets it detect:

• HelmRelease (chart.spec.chart and version)
• OCIRepository
• GitRepository

It also keeps supporting plain Kubernetes resources — Deployments, DaemonSets, etc. — for container images.

🚀 Renovate opens an issue called Dependency Dashboard, where you can:

• See the list of detected updates.
• Force PR creation manually.
• Approve the PRs.

---

👉 Final Result

With this setup:

• ✅ FluxCD + Renovate + GitOps → always up-to-date manifests.
• ✅ Renovate automatically opens PRs for Docker images and Helm charts.
• ✅ Everything is managed through the Dependency Dashboard.

🚀 Enjoy!

👉 Extra tip

I’d also recommend integrating GitHub with Slack to get notifications straight in your channel: github.com/integrations/slack