Follow-up to #34, same root problem: no application has had an image rolled out since the image-updater upgrade.
#34 restored discovery (the CR now reports applications=6 images_considered=6), which exposed the next link:
level=error msg="Could not get tags from registry: Get \"https://gitea.arcodange.lab/v2/\": tls: failed to verify certificate: x509: certificate signed by unknown authority" ... images_updated=0 errors=6
The nodes trust the lab root CA through the OS store (/usr/local/share/ca-certificates/arcodange-root.crt) — that is why kubelet pulls images fine — but the updater container carries its own trust store.
Fix: ship the root CA (public material, no private key) as a ConfigMap and mount it at /etc/ssl/certs/arcodange-root.crt via subPath. Go reads every file in that directory in addition to the bundle, so the image's own certs are untouched and public TLS keeps working.
Verified beforehand that the registry serves anonymous pulls through the standard Docker token flow (/v2/token?scope=repository:arcodange/kadans:pull → tags list) — so trust was the only missing piece; no credentials needed.
helm lint + helm template OK (ConfigMap renders, volumes/volumeMounts reach the HelmChart values).
Follow-up to #34, same root problem: **no application has had an image rolled out since the image-updater upgrade**.
#34 restored discovery (the CR now reports `applications=6 images_considered=6`), which exposed the next link:
```
level=error msg="Could not get tags from registry: Get \"https://gitea.arcodange.lab/v2/\": tls: failed to verify certificate: x509: certificate signed by unknown authority" ... images_updated=0 errors=6
```
The nodes trust the lab root CA through the OS store (`/usr/local/share/ca-certificates/arcodange-root.crt`) — that is why kubelet pulls images fine — but the updater container carries its own trust store.
**Fix:** ship the root CA (public material, no private key) as a ConfigMap and mount it at `/etc/ssl/certs/arcodange-root.crt` via `subPath`. Go reads every file in that directory *in addition to* the bundle, so the image's own certs are untouched and public TLS keeps working.
Verified beforehand that the registry serves **anonymous** pulls through the standard Docker token flow (`/v2/token?scope=repository:arcodange/kadans:pull` → tags list) — so trust was the only missing piece; **no credentials needed**.
`helm lint` + `helm template` OK (ConfigMap renders, volumes/volumeMounts reach the HelmChart values).
🤖 Generated with [Claude Code](https://claude.com/claude-code)
https://claude.ai/code/session_013ws8L74dVZmp97Wu36fm8j
With the ImageUpdater CR in place (#34) the updater finally sees all six
annotated applications, and every single registry query dies on
"x509: certificate signed by unknown authority": nodes trust the lab root
through the OS store, but the container carries its own.
Mount the root CA (public material, no key) into /etc/ssl/certs via subPath —
Go reads every file in that directory on top of the bundle, so the image's own
certs stay untouched. The registry allows anonymous pulls, so trust was the
only missing piece; no credentials needed.
Co-Authored-By: Claude Fable 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_013ws8L74dVZmp97Wu36fm8j
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Follow-up to #34, same root problem: no application has had an image rolled out since the image-updater upgrade.
#34 restored discovery (the CR now reports
applications=6 images_considered=6), which exposed the next link:The nodes trust the lab root CA through the OS store (
/usr/local/share/ca-certificates/arcodange-root.crt) — that is why kubelet pulls images fine — but the updater container carries its own trust store.Fix: ship the root CA (public material, no private key) as a ConfigMap and mount it at
/etc/ssl/certs/arcodange-root.crtviasubPath. Go reads every file in that directory in addition to the bundle, so the image's own certs are untouched and public TLS keeps working.Verified beforehand that the registry serves anonymous pulls through the standard Docker token flow (
/v2/token?scope=repository:arcodange/kadans:pull→ tags list) — so trust was the only missing piece; no credentials needed.helm lint+helm templateOK (ConfigMap renders, volumes/volumeMounts reach the HelmChart values).🤖 Generated with Claude Code
https://claude.ai/code/session_013ws8L74dVZmp97Wu36fm8j