feat: Add Vault variant

Please don't try to override it or you might break the default template implementation.

:warning: Dependending on the number of projects to inspect, Renovate can use quite a lot of resources (especially cache). Moreover, if lots of dependencies need to be updated, lots of pipelines will be triggered which will again use lots of resources. Therefore make sure to choose a wise schedule for the Renovate job. Once a week seems to be a good starting point.

## Variants

The Renovate template can be used in conjunction with template variants to cover specific cases.

### Vault variant

This variant allows delegating your secrets management to a [Vault](https://www.vaultproject.io/) server.

#### Configuration

In order to be able to communicate with the Vault server, the variant requires the additional configuration parameters:

| Input / Variable  | Description                            | Default value     |

| ----------------- | -------------------------------------- | ----------------- |

| `TBC_VAULT_IMAGE` | The [Vault Secrets Provider](https://gitlab.com/to-be-continuous/tools/vault-secrets-provider) image to use (can be overridden) | `registry.gitlab.com/to-be-continuous/tools/vault-secrets-provider:latest` |

| `vault-base-url` / `VAULT_BASE_URL` | The Vault server base API url          | **must be defined** |

| `vault-oidc-aud` / `VAULT_OIDC_AUD` | The `aud` claim for the JWT | `$CI_SERVER_URL` |

| :lock: `VAULT_ROLE_ID`   | The [AppRole](https://www.vaultproject.io/docs/auth/approle) RoleID | _none_ |

| :lock: `VAULT_SECRET_ID` | The [AppRole](https://www.vaultproject.io/docs/auth/approle) SecretID | _none_ |

By default, the variant will authenticate using a [JWT ID token](https://docs.gitlab.com/ci/secrets/id_token_authentication/). To use [AppRole](https://www.vaultproject.io/docs/auth/approle) instead the `VAULT_ROLE_ID` and `VAULT_SECRET_ID` should be defined as secret project variables.

#### Usage

Then you may retrieve any of your secret(s) from Vault using the following syntax:

```text

@url@http://vault-secrets-provider/api/secrets/{secret_path}?field={field}

```

With:

| Parameter                        | Description                            |

| -------------------------------- | -------------------------------------- |

| `secret_path` (_path parameter_) | this is your secret location in the Vault server |

| `field` (_query parameter_)      | parameter to access a single basic field from the secret JSON payload |

#### Example

```yaml

include:

  # main template

  - component: $CI_SERVER_FQDN/to-be-continuous/renovate/gitlab-ci-renovate@1.9.0

  # Vault variant

  - component: $CI_SERVER_FQDN/to-be-continuous/renovate/gitlab-ci-renovate-vault@1.9.0

    inputs:

      # audience claim for JWT

      vault-oidc-aud: "https://vault.acme.host"

      vault-base-url: "https://vault.acme.host/v1"

variables:

  # Secrets managed by Vault

  RENOVATE_TOKEN: "@url@http://vault-secrets-provider/api/secrets/b7ecb6ebabc231/renovate/gitlab?field=token"

  GITHUB_COM_TOKEN: "@url@http://vault-secrets-provider/api/secrets/b7ecb6ebabc231/renovate/github?field=token"

```

# =====================================================================================================================

# === Vault template variant

# =====================================================================================================================

spec:

  inputs:

    vault-base-url:

      description: The Vault server base API url

      default: ''

    vault-oidc-aud:

      description: The `aud` claim for the JWT

      default: $CI_SERVER_URL

---

variables:

  # variabilized vault-secrets-provider image

  TBC_VAULT_IMAGE: registry.gitlab.com/to-be-continuous/tools/vault-secrets-provider:latest

  # variables have to be explicitly declared in the YAML to be exported to the service

  VAULT_ROLE_ID: "$VAULT_ROLE_ID"

  VAULT_SECRET_ID: "$VAULT_SECRET_ID"

  VAULT_OIDC_AUD: $[[ inputs.vault-oidc-aud ]]

  VAULT_BASE_URL: $[[ inputs.vault-base-url ]]

.renovate-base:

  services:

    - name: "$TBC_TRACKING_IMAGE"

      command: ["--service", "renovate", "1.9.0"]

    - name: "$TBC_VAULT_IMAGE"

      alias: "vault-secrets-provider"

      variables:

        SKIP_SSL: "false"

  variables:

    VAULT_JWT_TOKEN: "$VAULT_JWT_TOKEN"

    VAULT_CA_CERTS: |

      $DEFAULT_CA_CERTS

      $CUSTOM_CA_CERTS

  id_tokens:

    VAULT_JWT_TOKEN:

      aud: "$VAULT_OIDC_AUD"