{{- /*
The lab's root CA, as a ConfigMap the image-updater pod can mount.

Nodes trust it through the OS store (/usr/local/share/ca-certificates), which
is why kubelet pulls images fine — but a container carries its own trust store,
so argocd-image-updater failed every registry query with
"x509: certificate signed by unknown authority" and updated nothing.

A root CA certificate is public material (no private key here), so it lives in
git next to the chart that consumes it.
*/ -}}
apiVersion: v1
kind: ConfigMap
metadata:
  name: homelab-ca
  namespace: argocd
data:
  arcodange-root.crt: |
{{ .Files.Get "files/arcodange-root.crt" | indent 4 }}