From f52b6973e12bcc962c7e94d8b5f3bbfbffbc4c72 Mon Sep 17 00:00:00 2001
From: Ruben Hensen <ruben.hensen@protonmail.com>
Date: Thu, 22 Oct 2026 09:13:01 +0200
Subject: [PATCH] gatus: mount a CA bundle without the compromised eMudhra
 roots

Mount patched-ca-bundle (see ca-bundle/) over /etc/ssl/certs so it stops trusting the compromised eMudhra intermediates (https://emudhra.we-have-a-problem.com).
---
 gatus/gatus-deployment.yaml | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/gatus/gatus-deployment.yaml b/gatus/gatus-deployment.yaml
index 6555bb3..3e3e85e 100644
--- a/gatus/gatus-deployment.yaml
+++ b/gatus/gatus-deployment.yaml
@@ -48,6 +48,11 @@ spec:
               readOnly: true
             - name: data
               mountPath: /data
+            # Trust store without the compromised eMudhra intermediates,
+            # see ca-bundle/. Drop once the image ships a fixed bundle.
+            - name: patched-ca-bundle
+              mountPath: /etc/ssl/certs
+              readOnly: true
       volumes:
         - name: config
           configMap:
@@ -55,3 +60,6 @@ spec:
         - name: data
           persistentVolumeClaim:
             claimName: gatus-data
+        - name: patched-ca-bundle
+          configMap:
+            name: patched-ca-bundle