# Mount patched-ca-bundle (from ca-bundle/) over /etc/ssl/certs so git, helm
# and the Go binaries stop trusting the compromised eMudhra intermediates.
# The whole directory is replaced because OpenSSL and Go also read the
# per-root files next to ca-certificates.crt. Drop this once Argo CD ships a
# fixed image.
apiVersion: apps/v1
kind: Deployment
metadata:
  name: argocd-server
spec:
  template:
    spec:
      containers:
        - name: argocd-server
          volumeMounts:
            - name: patched-ca-bundle
              mountPath: /etc/ssl/certs
              readOnly: true
      volumes:
        - name: patched-ca-bundle
          configMap:
            name: patched-ca-bundle
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: argocd-repo-server
spec:
  template:
    spec:
      containers:
        - name: argocd-repo-server
          volumeMounts:
            - name: patched-ca-bundle
              mountPath: /etc/ssl/certs
              readOnly: true
      volumes:
        - name: patched-ca-bundle
          configMap:
            name: patched-ca-bundle
---
apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: argocd-application-controller
spec:
  template:
    spec:
      containers:
        - name: argocd-application-controller
          volumeMounts:
            - name: patched-ca-bundle
              mountPath: /etc/ssl/certs
              readOnly: true
      volumes:
        - name: patched-ca-bundle
          configMap:
            name: patched-ca-bundle
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: argocd-applicationset-controller
spec:
  template:
    spec:
      containers:
        - name: argocd-applicationset-controller
          volumeMounts:
            - name: patched-ca-bundle
              mountPath: /etc/ssl/certs
              readOnly: true
      volumes:
        - name: patched-ca-bundle
          configMap:
            name: patched-ca-bundle
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: argocd-notifications-controller
spec:
  template:
    spec:
      containers:
        - name: argocd-notifications-controller
          volumeMounts:
            - name: patched-ca-bundle
              mountPath: /etc/ssl/certs
              readOnly: true
      volumes:
        - name: patched-ca-bundle
          configMap:
            name: patched-ca-bundle
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: argocd-dex-server
spec:
  template:
    spec:
      containers:
        - name: dex
          volumeMounts:
            - name: patched-ca-bundle
              mountPath: /etc/ssl/certs
              readOnly: true
      volumes:
        - name: patched-ca-bundle
          configMap:
            name: patched-ca-bundle