Skip to content
fzymgc-house Cluster Docs

Expose Renovate CE via dual trigger: scheduler plus webhook

Date: 2026-06-14 Status: Accepted Decision: hl-5sr0 Deciders: Sean Brandt

Context

Section titled “Context”

Renovate CE supports two independent trigger paths: a periodic autodiscovery scheduler (outbound-only, no inbound network exposure) and a webhook handler (inbound, requires a public internet endpoint). The cluster already runs a Cloudflare-tunnel webhook_services pattern (reused by ArgoCD and Octopus/fovea). Scheduler-only means delayed reaction to merges and config edits; webhook-only means no baseline sweep if webhook delivery fails.

Decision

Section titled “Decision”

Enable both the autodiscovery scheduler (MEND_RNV_CRON_APP_SYNC, default ~4h) and the webhook handler, exposing /webhook via the existing Cloudflare-tunnel webhook_services pattern secured by an HMAC webhook secret.

Rationale

Section titled “Rationale”
  • Scheduler provides a resilient baseline; webhook provides responsiveness — neither alone is sufficient at production cadence.
  • Reuses the established webhook_services Cloudflare-tunnel pattern (ArgoCD, Octopus, fovea) rather than introducing a new exposure mechanism.
  • HMAC webhook secret is the only auth on /webhook (GitHub must reach it anonymously); a NetworkPolicy restricts ingress to the cloudflared namespace.

Alternatives Considered

Section titled “Alternatives Considered”
  • Scheduler + webhook, both active (chosen): baseline coverage plus instant responsiveness; reuses the existing tunnel pattern. Cost: a public webhook endpoint and slightly more surface area.
  • Scheduler only (rejected): zero inbound exposure, but reactions to merges/new installs lag by up to the cron interval (~4h).
  • Webhook only (rejected): instant reaction, but a missed/failed webhook delivery leaves repos un-updated indefinitely with no baseline sweep.

Consequences

Section titled “Consequences”
  • Positive: instant reaction to merges, new installs, and renovate.json edits; baseline sweep catches anything webhook delivery misses.
  • Negative: requires a public internet endpoint and an additional Cloudflare tunnel entry; HMAC is the sole auth on the webhook path (by design, a deliberate trust exposure).
  • Neutral: NetworkPolicy must allow ingress from the cloudflared namespace and egress to the GitHub API and package registries.