argocd: mount a CA bundle without the compromised eMudhra roots

The Argo CD v2.14.2 image (Ubuntu 24.04, ca-certificates 20240203) and the
dex image still trust the eMudhra intermediates whose keys leaked
(https://emudhra.we-have-a-problem.com), and the repo server fetches git
and Helm repos over that trust store. A forged certificate there means
arbitrary manifests in the cluster.

patched-ca-bundle holds the bundle from Alpine ca-certificates-bundle
20261020-r0 and replaces /etc/ssl/certs in every Argo CD container except
redis. The whole directory goes, since OpenSSL and Go also read the
per-root files next to ca-certificates.crt. It uses server-side apply to
keep the bundle out of the last-applied annotation.

argocd/kustomization.yaml

@@ -9,6 +9,7 @@ resources:
 - https://raw.githubusercontent.com/argoproj/argo-cd/refs/tags/v2.14.2/manifests/install.yaml
 - ingress.yaml
 - oidc-secret.yaml
+- patched-ca-bundle.yaml
 
 patches:
   - target:
@@ -18,4 +19,5 @@ patches:
       name: argocd-notifications-controller
     path: overlays/argocd-notifications-controller-patch.yaml
   - path: overlays/argocd-cm.patch.yaml
-  - path: overlays/argocd-rbac-cm.patch.yaml
+  - path: overlays/argocd-rbac-cm.patch.yaml
+  - path: overlays/patched-ca-bundle.patch.yaml

argocd/overlays/patched-ca-bundle.patch.yaml

@@ -0,0 +1,111 @@
+# Mount patched-ca-bundle over /etc/ssl/certs so git, helm and the Go
+# binaries stop trusting the compromised eMudhra intermediates. The whole
+# directory is replaced because OpenSSL and Go also read the per-root files
+# next to ca-certificates.crt. Drop this once Argo CD ships a fixed image.
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: argocd-server
+spec:
+  template:
+    spec:
+      containers:
+        - name: argocd-server
+          volumeMounts:
+            - name: patched-ca-bundle
+              mountPath: /etc/ssl/certs
+              readOnly: true
+      volumes:
+        - name: patched-ca-bundle
+          configMap:
+            name: patched-ca-bundle
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: argocd-repo-server
+spec:
+  template:
+    spec:
+      containers:
+        - name: argocd-repo-server
+          volumeMounts:
+            - name: patched-ca-bundle
+              mountPath: /etc/ssl/certs
+              readOnly: true
+      volumes:
+        - name: patched-ca-bundle
+          configMap:
+            name: patched-ca-bundle
+---
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: argocd-application-controller
+spec:
+  template:
+    spec:
+      containers:
+        - name: argocd-application-controller
+          volumeMounts:
+            - name: patched-ca-bundle
+              mountPath: /etc/ssl/certs
+              readOnly: true
+      volumes:
+        - name: patched-ca-bundle
+          configMap:
+            name: patched-ca-bundle
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: argocd-applicationset-controller
+spec:
+  template:
+    spec:
+      containers:
+        - name: argocd-applicationset-controller
+          volumeMounts:
+            - name: patched-ca-bundle
+              mountPath: /etc/ssl/certs
+              readOnly: true
+      volumes:
+        - name: patched-ca-bundle
+          configMap:
+            name: patched-ca-bundle
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: argocd-notifications-controller
+spec:
+  template:
+    spec:
+      containers:
+        - name: argocd-notifications-controller
+          volumeMounts:
+            - name: patched-ca-bundle
+              mountPath: /etc/ssl/certs
+              readOnly: true
+      volumes:
+        - name: patched-ca-bundle
+          configMap:
+            name: patched-ca-bundle
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: argocd-dex-server
+spec:
+  template:
+    spec:
+      containers:
+        - name: dex
+          volumeMounts:
+            - name: patched-ca-bundle
+              mountPath: /etc/ssl/certs
+              readOnly: true
+      volumes:
+        - name: patched-ca-bundle
+          configMap:
+            name: patched-ca-bundle