fix(argocd): let the image-updater trust the lab CA — the last blocker to rollouts (#36)

Co-authored-by: Gabriel Radureau <[email protected]>
Co-committed-by: Gabriel Radureau <[email protected]>

argocd/templates/homelab_ca.yaml

@@ -0,0 +1,19 @@
+{{- /*
+The lab's root CA, as a ConfigMap the image-updater pod can mount.
+
+Nodes trust it through the OS store (/usr/local/share/ca-certificates), which
+is why kubelet pulls images fine — but a container carries its own trust store,
+so argocd-image-updater failed every registry query with
+"x509: certificate signed by unknown authority" and updated nothing.
+
+A root CA certificate is public material (no private key here), so it lives in
+git next to the chart that consumes it.
+*/ -}}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: homelab-ca
+  namespace: argocd
+data:
+  arcodange-root.crt: |
+{{ .Files.Get "files/arcodange-root.crt" | indent 4 }}