Add CA certificates bundle and update Headlamp configuration for OIDC

clusters/noble/bootstrap/headlamp/README.md

@@ -4,6 +4,7 @@
 
 - **Chart:** `headlamp/headlamp` **0.42.0** (`config.sessionTTL: null` still omits **`-session-ttl`** if needed — [issue #4883](https://github.com/kubernetes-sigs/headlamp/issues/4883))
 - **Namespace:** `headlamp`
+- **OIDC TLS:** **`cacert.pem`** (Mozilla bundle from [curl CA extract](https://curl.se/ca/cacert.pem)) is baked into ConfigMap **`headlamp-oidc-ca-bundle`** via **`kustomization.yaml`** and mounted at **`/etc/ssl/headlamp/oidc-ca-bundle.pem`** for **`-oidc-ca-file`** (stops empty-PEM log noise; refresh the file occasionally). If Authentik used a **private** CA, append that PEM to **`cacert.pem`** (or replace) before sync.
 
 ## Install
 

clusters/noble/bootstrap/headlamp/kustomization.yaml

@@ -2,6 +2,14 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 # namespace.yaml is owned by noble-bootstrap-root (clusters/noble/bootstrap/kustomization.yaml).
 # Do not include it here — two Applications owning the same Namespace causes SharedResourceWarning.
+generatorOptions:
+  disableNameSuffixHash: true
+configMapGenerator:
+  # Mozilla CA bundle (https://curl.se/ca/cacert.pem) — mounted for **-oidc-ca-file** so Headlamp’s OIDC
+  # client uses a non-empty PEM pool (avoids spurious “failed to append ca cert to pool” when IdP TLS is public PKI).
+  - name: headlamp-oidc-ca-bundle
+    files:
+      - oidc-ca-bundle.pem=cacert.pem
 resources:
   - metrics-clusterrolebinding.yaml
   - oidc-noble-admins-clusterrolebinding.yaml

clusters/noble/bootstrap/headlamp/values.yaml

@@ -19,6 +19,19 @@ clusterRoleBinding:
 # Optional: set **config.sessionTTL** (seconds) or **null** to omit **-session-ttl** (see headlamp#4883 for older chart/binary mismatches).
 config:
   sessionTTL: null
+  extraArgs:
+    # PEM pool from ConfigMap **headlamp-oidc-ca-bundle** (see **kustomization.yaml** + **cacert.pem**).
+    - "-oidc-ca-file=/etc/ssl/headlamp/oidc-ca-bundle.pem"
+
+volumeMounts:
+  - name: oidc-ca-bundle
+    mountPath: /etc/ssl/headlamp
+    readOnly: true
+
+volumes:
+  - name: oidc-ca-bundle
+    configMap:
+      name: headlamp-oidc-ca-bundle
 
 ingress:
   enabled: true