Automated dependency updates

[AverageMarcus]

We've had several PRs lately to bump versions of various dependencies that we've noticed have become several versions out of date. We tend to do this on an ad-hoc basis when we remember to or someone needs a new feature from a dependency.

Because of this, we often find out quite a bit later about breaking changes in dependencies that we then need to also resolve at the same time as trying to update everything.

To avoid this I think it would be useful to introduce automated dependency updates on the repo so that we get new PRs every time a new version of something is available and we can then test change version bump in isolation from any other changes.

I recommend using Renovate to handle this as its free for public repos and is extremely configurable. There are also alternatives such as Dependabot but I'm less familiar with those so couldn't say for sure if they meet all our requirements.

We have versions configured in several different places so we'd need a solution that could handle the following:

• Within the Dockerfile
• Within script files as variables
• Within packer config files
• In Packer plugin configs

Ideally, we'd also need a solution that supported updating the associated SHA256 values as well as the version but as of now I'm not aware of any tools that can handle that. [Renovate feature request]

[mboersma]

Dependabot would only help with the Dockerfile, and perhaps with tools such as Packer and Ansible if we were to put those in a requirements.txt. I don't think there's a way to write a custom "ecosystem provider" either.

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue as fresh with /remove-lifecycle stale
• Close this issue with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[k8s-triage-robot]

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue as fresh with /remove-lifecycle rotten
• Close this issue with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle rotten

[AverageMarcus]

/remove-lifecycle rotten

[AverageMarcus]

An idea that came from this Slack thread is to have a periodic job that fetches the latest URLs and also fetches the checksums and generates a PR with the changes.

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue as fresh with /remove-lifecycle stale
• Close this issue with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[k8s-triage-robot]

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue as fresh with /remove-lifecycle rotten
• Close this issue with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle rotten

[AverageMarcus]

I'd still like this eventually

/remove-lifecycle rotten