mirror of
https://github.com/rubenhensen/k8scd.git
synced 2026-11-15 22:29:09 +01:00
Ruben Hensen
9a984c724c
Nine more namespaces need patched-ca-bundle, the bundle from Alpine ca-certificates-bundle 20261020-r0 without the roots above the compromised eMudhra intermediates. Rather than another nine ~190KB copies, a small chart renders the ConfigMap from one ca-certificates.crt into every namespace in values.yaml. argocd, authentik and actual-budget keep their own copies for now.
21 lines
686 B
YAML
21 lines
686 B
YAML
{{- /*
|
|
Temporary CA bundle: ca-certificates.crt is /etc/ssl/certs/ca-certificates.crt
|
|
from Alpine ca-certificates-bundle 20261020-r0, which drops the roots above
|
|
the compromised eMudhra intermediates (https://emudhra.we-have-a-problem.com).
|
|
Workloads mount it over /etc/ssl/certs until their images ship a fixed
|
|
bundle. Server-side apply keeps the bundle out of the last-applied annotation.
|
|
*/}}
|
|
{{- range .Values.namespaces }}
|
|
---
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: patched-ca-bundle
|
|
namespace: {{ . }}
|
|
annotations:
|
|
argocd.argoproj.io/sync-options: ServerSideApply=true
|
|
data:
|
|
ca-certificates.crt: |
|
|
{{ $.Files.Get "ca-certificates.crt" | indent 4 }}
|
|
{{- end }}
|