ghost-blog: use a CA bundle without the compromised eMudhra roots

Mount patched-ca-bundle (see ca-bundle/) over /etc/ssl/certs so it stops trusting the compromised eMudhra intermediates (https://emudhra.we-have-a-problem.com). Node uses its built-in roots, so also switch it to OpenSSL's store with --use-openssl-ca.

ghost-blog/ghost-deployment.yaml

@@ -37,6 +37,9 @@ spec:
       - name: tmp
         emptyDir:
           sizeLimit: 64Mi
+      - name: patched-ca-bundle
+        configMap:
+          name: patched-ca-bundle
 
       initContainers:
       - name: permissions-fix
@@ -136,6 +139,13 @@ spec:
               key: MYSQL_DATABASE
         - name: url
           value: https://blog.rubenhensen.nl
+        # Node trusts its built-in roots, which still include the ones above
+        # the compromised eMudhra intermediates. Use patched-ca-bundle through
+        # OpenSSL instead until Node ships a fix.
+        - name: NODE_OPTIONS
+          value: --use-openssl-ca
+        - name: SSL_CERT_FILE
+          value: /etc/ssl/certs/ca-certificates.crt
         envFrom:
         - secretRef:
             name: ghost-mail-config
@@ -153,6 +163,9 @@ spec:
         - name: tmp
           mountPath: /tmp
           readOnly: false
+        - name: patched-ca-bundle
+          mountPath: /etc/ssl/certs
+          readOnly: true
         securityContext:
           allowPrivilegeEscalation: false
           runAsNonRoot: true