fix(vault): install ca-certificates + fix deploy workflow paths and attribution - #12
Merged
Merged
Conversation
Go's crypto/x509 was failing to validate outbound HTTPS in the alpine:3.19 runtime image — including OIDC discovery when registering a Kubernetes cluster whose issuer is served behind a public Let's Encrypt cert. The builder stage installed ca-certificates but that layer was discarded when switching to the minimal runtime. Adding `apk --no-cache add ca-certificates` in the runtime stage registers the standard CA bundle at /etc/ssl/certs/ca-certificates.crt in the way Go expects. Workaround in the meantime (in Gaucho-Racing/infrastructure PR #127): set SSL_CERT_FILE + SSL_CERT_DIR on the vault Deployment to force Go to load the bundle. Once this image is released and rolled out, those env vars can go.
BK1031
changed the title
…ute commits to @gauchoracing Two fixes to the release deploy workflow: 1. Update the kustomization path from kubernetes/manifests/vault/kustomization.yaml to kubernetes/gr-foundry/manifests/vault/kustomization.yaml after the infra repo reorganized its Kubernetes tree per-cluster under gr-prod/ and gr-foundry/. Vault now lives on gr-foundry, so the deploy job needs to bump the tag in that path. 2. Attribute the bump commit to the @gauchoracing service account (via the noreply email format 153126024+gauchoracing@users.noreply.github.com) instead of github-actions[bot]. The PAT this job uses already belongs to @gauchoracing; matching the commit author to that identity makes the PRs show as opened AND authored by @gauchoracing in the infra repo, so the audit trail is consistent.
BK1031
force-pushed
the
bk1031/dockerfile-ca-certificates
branch
from
July 8, 2026 06:24
d3bf72a to
5a42211
Compare
Adds a "Click here to view all changes" link pointing at GitHub's compare view for OLD_TAG..NEW_TAG in the vault repo. Renders as the final content line before the auto-generated footer, so a reviewer can jump straight to the full unified diff instead of clicking through individual commits. Uses the same OLD_TAG / NEW_TAG / VAULT_REPO variables the changelog generation already resolves.
2 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bundle of small fixes:
1. Install ca-certificates in the runtime image
The `alpine:3.19` runtime image didn't have the `ca-certificates` package installed, so Go's `crypto/x509` couldn't validate outbound HTTPS handshakes reliably. `POST /integrations/kubernetes/clusters/verify` was returning 502 in ~50ms because `kubernetes.NewVerifier(...).Check(ctx)` couldn't fetch the OIDC discovery doc — TLS handshake failed for lack of a CA bundle Go could find.
The base image ships `/etc/ssl/certs/ca-certificates.crt` (219KB, 146 CAs) copied from something upstream, and busybox wget's TLS library finds it. But Go's SystemCertPool probes a specific list of paths and requires the file to be registered via the ca-certificates package (or picked up by `update-ca-certificates` at install time) — the raw file existing isn't sufficient in every case.
Adding `RUN apk --no-cache add ca-certificates` in the runtime stage resolves this properly.
2. Update deploy workflow to reference the new infra path
After the infra repo reorganized its Kubernetes tree per-cluster (Gaucho-Racing/infrastructure PR #121), vault lives on gr-foundry at:
`kubernetes/gr-foundry/manifests/vault/kustomization.yaml`
The deploy workflow was still pointing at the old `kubernetes/manifests/vault/kustomization.yaml` and would silently do nothing on the next release. Updating.
3. Attribute deploy commits to @gauchoracing
The PAT the deploy workflow uses to open PRs against the infra repo belongs to the @gauchoracing service account, but the commits were being authored as `github-actions[bot]`. Setting git config to `GR Admin team@gauchoracing.com` — that email is verified on the @gauchoracing account, so GitHub links commits + the PR opener both show as @gauchoracing.
Related infra changes
Test plan