arcodangeandClaude Fable 5
4d67f699a1
With the ImageUpdater CR in place (#34) the updater finally sees all six annotated applications, and every single registry query dies on "x509: certificate signed by unknown authority": nodes trust the lab root through the OS store, but the container carries its own. Mount the root CA (public material, no key) into /etc/ssl/certs via subPath — Go reads every file in that directory on top of the bundle, so the image's own certs stay untouched. The registry allows anonymous pulls, so trust was the only missing piece; no credentials needed. Co-Authored-By: Claude Fable 5 <[email protected]> Claude-Session: https://claude.ai/code/session_013ws8L74dVZmp97Wu36fm8j
20 lines
653 B
YAML
20 lines
653 B
YAML
{{- /*
|
|
The lab's root CA, as a ConfigMap the image-updater pod can mount.
|
|
|
|
Nodes trust it through the OS store (/usr/local/share/ca-certificates), which
|
|
is why kubelet pulls images fine — but a container carries its own trust store,
|
|
so argocd-image-updater failed every registry query with
|
|
"x509: certificate signed by unknown authority" and updated nothing.
|
|
|
|
A root CA certificate is public material (no private key here), so it lives in
|
|
git next to the chart that consumes it.
|
|
*/ -}}
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: homelab-ca
|
|
namespace: argocd
|
|
data:
|
|
arcodange-root.crt: |
|
|
{{ .Files.Get "files/arcodange-root.crt" | indent 4 }}
|