cert-manager: mount a CA bundle without the compromised eMudhra roots

Mount patched-ca-bundle (see ca-bundle/) over /etc/ssl/certs so it stops trusting the compromised eMudhra intermediates (https://emudhra.we-have-a-problem.com). Only the controller, which talks ACME to Let's Encrypt.

apps/templates/cert-manager-helm.yaml

@@ -18,6 +18,17 @@ spec:
       parameters:
         - name: crds.enabled
           value: 'true'
+      # The controller talks ACME to Let's Encrypt. Give it a trust store
+      # without the compromised eMudhra intermediates, see ca-bundle/.
+      values: |
+        volumes:
+          - name: patched-ca-bundle
+            configMap:
+              name: patched-ca-bundle
+        volumeMounts:
+          - name: patched-ca-bundle
+            mountPath: /etc/ssl/certs
+            readOnly: true
   syncPolicy:
     syncOptions:
     - CreateNamespace=true