From 4d67f699a1f0b5da4d53e58baed9b0feba9581c7 Mon Sep 17 00:00:00 2001 From: Gabriel Radureau Date: Mon, 20 Jul 2026 09:10:59 +0200 Subject: [PATCH] =?UTF-8?q?fix(argocd):=20let=20the=20image-updater=20trus?= =?UTF-8?q?t=20the=20lab=20CA=20=E2=80=94=20the=20last=20blocker=20to=20ro?= =?UTF-8?q?llouts?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit With the ImageUpdater CR in place (#34) the updater finally sees all six annotated applications, and every single registry query dies on "x509: certificate signed by unknown authority": nodes trust the lab root through the OS store, but the container carries its own. Mount the root CA (public material, no key) into /etc/ssl/certs via subPath — Go reads every file in that directory on top of the bundle, so the image's own certs stay untouched. The registry allows anonymous pulls, so trust was the only missing piece; no credentials needed. Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_013ws8L74dVZmp97Wu36fm8j --- argocd/files/arcodange-root.crt | 12 ++++++++++++ argocd/templates/homelab_ca.yaml | 19 +++++++++++++++++++ argocd/values.yaml | 15 +++++++++++++++ 3 files changed, 46 insertions(+) create mode 100644 argocd/files/arcodange-root.crt create mode 100644 argocd/templates/homelab_ca.yaml diff --git a/argocd/files/arcodange-root.crt b/argocd/files/arcodange-root.crt new file mode 100644 index 0000000..6b542c1 --- /dev/null +++ b/argocd/files/arcodange-root.crt @@ -0,0 +1,12 @@ +-----BEGIN CERTIFICATE----- +MIIBwDCCAWagAwIBAgIRAJzOnXbHdqAB0QnEjNw21xgwCgYIKoZIzj0EAwIwPjEZ +MBcGA1UEChMQQXJjb2RhbmdlIExhYiBDQTEhMB8GA1UEAxMYQXJjb2RhbmdlIExh +YiBDQSBSb290IENBMB4XDTI1MTIyOTA5Mjk0NVoXDTM1MTIyNzA5Mjk0NVowPjEZ +MBcGA1UEChMQQXJjb2RhbmdlIExhYiBDQTEhMB8GA1UEAxMYQXJjb2RhbmdlIExh +YiBDQSBSb290IENBMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAERTF3M6MtqK4m +q4e38e1KzHP7TRrf/DwEwxyafyp9iONE6na0+dgPvXPurG0kmom9PIYA2aE2eCzz +hFkQ2DO1TqNFMEMwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8CAQEw +HQYDVR0OBBYEFJCxc6tumAlVAaUjoKExPcNZsVoYMAoGCCqGSM49BAMCA0gAMEUC +IGtrew3FOPh16x3XevWCO8suH7laCn8kTV2ZZpAK0UkhAiEA/bA7HiDqEaXHSc35 +b7fZX1fuKI6SdEWN9hj5EwP45Z8= +-----END CERTIFICATE----- diff --git a/argocd/templates/homelab_ca.yaml b/argocd/templates/homelab_ca.yaml new file mode 100644 index 0000000..e8a38f2 --- /dev/null +++ b/argocd/templates/homelab_ca.yaml @@ -0,0 +1,19 @@ +{{- /* +The lab's root CA, as a ConfigMap the image-updater pod can mount. + +Nodes trust it through the OS store (/usr/local/share/ca-certificates), which +is why kubelet pulls images fine — but a container carries its own trust store, +so argocd-image-updater failed every registry query with +"x509: certificate signed by unknown authority" and updated nothing. + +A root CA certificate is public material (no private key here), so it lives in +git next to the chart that consumes it. +*/ -}} +apiVersion: v1 +kind: ConfigMap +metadata: + name: homelab-ca + namespace: argocd +data: + arcodange-root.crt: | +{{ .Files.Get "files/arcodange-root.crt" | indent 4 }} diff --git a/argocd/values.yaml b/argocd/values.yaml index 4e0d108..d52ba61 100644 --- a/argocd/values.yaml +++ b/argocd/values.yaml @@ -57,3 +57,18 @@ argocd_image_updater_chart_values: serverAddress: "https://argocd.arcodange.lab/" insecure: true plaintext: true + # The lab CA, so the updater can talk to the Gitea registry over TLS. + # Go reads every file in /etc/ssl/certs on top of the bundle, so dropping our + # root in there (subPath — the image's own certs stay untouched) is enough. + # Without it every query died on "certificate signed by unknown authority" + # and no image was ever rolled out. The registry itself allows anonymous + # pulls, so no credentials are needed — trust was the only missing piece. + volumes: + - name: homelab-ca + configMap: + name: homelab-ca + volumeMounts: + - name: homelab-ca + mountPath: /etc/ssl/certs/arcodange-root.crt + subPath: arcodange-root.crt + readOnly: true -- 2.54.0