2 Commits

Include renames

Author	SHA1	Message	Date
Ruben Hensen	fe678d4b4b	ca-bundle: also serve argocd, authentik and actual-budget ... Those three namespaces had their own ~190KB copy of patched-ca-bundle. Let the ca-bundle chart render them too, so the bundle lives in one file.	2026-10-22 09:26:43 +02:00
Ruben Hensen	a507282103	argocd: mount a CA bundle without the compromised eMudhra roots ... The Argo CD v2.14.2 image (Ubuntu 24.04, ca-certificates 20240203) and the dex image still trust the eMudhra intermediates whose keys leaked (https://emudhra.we-have-a-problem.com), and the repo server fetches git and Helm repos over that trust store. A forged certificate there means arbitrary manifests in the cluster. patched-ca-bundle holds the bundle from Alpine ca-certificates-bundle 20261020-r0 and replaces /etc/ssl/certs in every Argo CD container except redis. The whole directory goes, since OpenSSL and Go also read the per-root files next to ca-certificates.crt. It uses server-side apply to keep the bundle out of the last-applied annotation.	2026-10-21 12:09:41 +02:00