ca-bundle: also serve argocd, authentik and actual-budget

Those three namespaces had their own ~190KB copy of patched-ca-bundle.
Let the ca-bundle chart render them too, so the bundle lives in one file.

argocd/kustomization.yaml

@@ -9,7 +9,6 @@ resources:
 - https://raw.githubusercontent.com/argoproj/argo-cd/refs/tags/v2.14.2/manifests/install.yaml
 - ingress.yaml
 - oidc-secret.yaml
-- patched-ca-bundle.yaml
 
 patches:
   - target:

argocd/overlays/patched-ca-bundle.patch.yaml

@@ -1,7 +1,8 @@
-# Mount patched-ca-bundle over /etc/ssl/certs so git, helm and the Go
-# binaries stop trusting the compromised eMudhra intermediates. The whole
-# directory is replaced because OpenSSL and Go also read the per-root files
-# next to ca-certificates.crt. Drop this once Argo CD ships a fixed image.
+# Mount patched-ca-bundle (from ca-bundle/) over /etc/ssl/certs so git, helm
+# and the Go binaries stop trusting the compromised eMudhra intermediates.
+# The whole directory is replaced because OpenSSL and Go also read the
+# per-root files next to ca-certificates.crt. Drop this once Argo CD ships a
+# fixed image.
 apiVersion: apps/v1
 kind: Deployment
 metadata:

ca-bundle/values.yaml

@@ -1,6 +1,8 @@
-# Namespaces that get the patched-ca-bundle ConfigMap. argocd, authentik and
-# actual-budget still have their own copy in their folders.
+# Namespaces that get the patched-ca-bundle ConfigMap.
 namespaces:
+  - actual-budget
+  - argocd
+  - authentik
   - bolletjestrui
   - cert-manager
   - gatus