mirror of
https://github.com/rubenhensen/k8scd.git
synced 2026-11-15 22:29:09 +01:00
Ruben Hensen
fe678d4b4b
Those three namespaces had their own ~190KB copy of patched-ca-bundle. Let the ca-bundle chart render them too, so the bundle lives in one file.
113 lines
2.7 KiB
YAML
113 lines
2.7 KiB
YAML
# Mount patched-ca-bundle (from ca-bundle/) over /etc/ssl/certs so git, helm
|
|
# and the Go binaries stop trusting the compromised eMudhra intermediates.
|
|
# The whole directory is replaced because OpenSSL and Go also read the
|
|
# per-root files next to ca-certificates.crt. Drop this once Argo CD ships a
|
|
# fixed image.
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: argocd-server
|
|
spec:
|
|
template:
|
|
spec:
|
|
containers:
|
|
- name: argocd-server
|
|
volumeMounts:
|
|
- name: patched-ca-bundle
|
|
mountPath: /etc/ssl/certs
|
|
readOnly: true
|
|
volumes:
|
|
- name: patched-ca-bundle
|
|
configMap:
|
|
name: patched-ca-bundle
|
|
---
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: argocd-repo-server
|
|
spec:
|
|
template:
|
|
spec:
|
|
containers:
|
|
- name: argocd-repo-server
|
|
volumeMounts:
|
|
- name: patched-ca-bundle
|
|
mountPath: /etc/ssl/certs
|
|
readOnly: true
|
|
volumes:
|
|
- name: patched-ca-bundle
|
|
configMap:
|
|
name: patched-ca-bundle
|
|
---
|
|
apiVersion: apps/v1
|
|
kind: StatefulSet
|
|
metadata:
|
|
name: argocd-application-controller
|
|
spec:
|
|
template:
|
|
spec:
|
|
containers:
|
|
- name: argocd-application-controller
|
|
volumeMounts:
|
|
- name: patched-ca-bundle
|
|
mountPath: /etc/ssl/certs
|
|
readOnly: true
|
|
volumes:
|
|
- name: patched-ca-bundle
|
|
configMap:
|
|
name: patched-ca-bundle
|
|
---
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: argocd-applicationset-controller
|
|
spec:
|
|
template:
|
|
spec:
|
|
containers:
|
|
- name: argocd-applicationset-controller
|
|
volumeMounts:
|
|
- name: patched-ca-bundle
|
|
mountPath: /etc/ssl/certs
|
|
readOnly: true
|
|
volumes:
|
|
- name: patched-ca-bundle
|
|
configMap:
|
|
name: patched-ca-bundle
|
|
---
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: argocd-notifications-controller
|
|
spec:
|
|
template:
|
|
spec:
|
|
containers:
|
|
- name: argocd-notifications-controller
|
|
volumeMounts:
|
|
- name: patched-ca-bundle
|
|
mountPath: /etc/ssl/certs
|
|
readOnly: true
|
|
volumes:
|
|
- name: patched-ca-bundle
|
|
configMap:
|
|
name: patched-ca-bundle
|
|
---
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: argocd-dex-server
|
|
spec:
|
|
template:
|
|
spec:
|
|
containers:
|
|
- name: dex
|
|
volumeMounts:
|
|
- name: patched-ca-bundle
|
|
mountPath: /etc/ssl/certs
|
|
readOnly: true
|
|
volumes:
|
|
- name: patched-ca-bundle
|
|
configMap:
|
|
name: patched-ca-bundle
|