Add a ca-bundle chart for the patched CA bundle

Nine more namespaces need patched-ca-bundle, the bundle from Alpine
ca-certificates-bundle 20261020-r0 without the roots above the compromised
eMudhra intermediates. Rather than another nine ~190KB copies, a small
chart renders the ConfigMap from one ca-certificates.crt into every
namespace in values.yaml. argocd, authentik and actual-budget keep their
own copies for now.

apps/templates/ca-bundle-folder.yaml

@@ -0,0 +1,21 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: ca-bundle
+  namespace: argocd
+  finalizers:
+  - resources-finalizer.argocd.argoproj.io
+spec:
+  project: default
+  source:
+    repoURL: https://github.com/rubenhensen/k8scd.git
+    targetRevision: HEAD
+    path: ca-bundle
+  destination:
+    server: https://kubernetes.default.svc
+    # Every ConfigMap sets its own namespace.
+    namespace: argocd
+  syncPolicy:
+    automated:
+      selfHeal: true
+      prune: true

ca-bundle/Chart.yaml

@@ -0,0 +1,5 @@
+apiVersion: v2
+name: ca-bundle
+description: Puts the patched-ca-bundle ConfigMap in every namespace listed in values.yaml
+type: application
+version: 0.1.0

ca-bundle/templates/configmaps.yaml

@@ -0,0 +1,20 @@
+{{- /*
+Temporary CA bundle: ca-certificates.crt is /etc/ssl/certs/ca-certificates.crt
+from Alpine ca-certificates-bundle 20261020-r0, which drops the roots above
+the compromised eMudhra intermediates (https://emudhra.we-have-a-problem.com).
+Workloads mount it over /etc/ssl/certs until their images ship a fixed
+bundle. Server-side apply keeps the bundle out of the last-applied annotation.
+*/}}
+{{- range .Values.namespaces }}
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: patched-ca-bundle
+  namespace: {{ . }}
+  annotations:
+    argocd.argoproj.io/sync-options: ServerSideApply=true
+data:
+  ca-certificates.crt: |
+{{ $.Files.Get "ca-certificates.crt" | indent 4 }}
+{{- end }}

ca-bundle/values.yaml

@@ -0,0 +1,12 @@
+# Namespaces that get the patched-ca-bundle ConfigMap. argocd, authentik and
+# actual-budget still have their own copy in their folders.
+namespaces:
+  - bolletjestrui
+  - cert-manager
+  - gatus
+  - ghost-blog
+  - gitea
+  - immich
+  - ntfy
+  - serpbear
+  - whisper