fix(argocd): let the image-updater trust the lab CA — the last blocker to rollouts (#36)

Co-authored-by: Gabriel Radureau <[email protected]>
Co-committed-by: Gabriel Radureau <[email protected]>

argocd/values.yaml

@@ -57,3 +57,18 @@ argocd_image_updater_chart_values:
       serverAddress: "https://argocd.arcodange.lab/"
       insecure: true
       plaintext: true
+  # The lab CA, so the updater can talk to the Gitea registry over TLS.
+  # Go reads every file in /etc/ssl/certs on top of the bundle, so dropping our
+  # root in there (subPath — the image's own certs stay untouched) is enough.
+  # Without it every query died on "certificate signed by unknown authority"
+  # and no image was ever rolled out. The registry itself allows anonymous
+  # pulls, so no credentials are needed — trust was the only missing piece.
+  volumes:
+    - name: homelab-ca
+      configMap:
+        name: homelab-ca
+  volumeMounts:
+    - name: homelab-ca
+      mountPath: /etc/ssl/certs/arcodange-root.crt
+      subPath: arcodange-root.crt
+      readOnly: true