flux bootstrap git cannot clone repo with custom CA certificate

[makkes]

Describe the bug

I'm running into a problem bootstrapping a repository served from a custom CA:

 flux bootstrap git --password=git123 --username=git --url=https://git.172.18.100.0.sslip.io/repo --path=flux --ca-file=ca.crt
► cloning branch "main" from Git repository "https://git.172.18.100.0.sslip.io/repo"
✗ failed to clone repository: Get "https://git.172.18.100.0.sslip.io/repo/info/refs?service=git-upload-pack": x509: certificate signed by unknown authority

The ca.crt file, however, contains the certificate that was used to sign the git server's certificate.

Steps to reproduce

1. start a kind cluster
2. start a Git server with a self-signed certificate or one signed by a custom CA
3. run above command

Expected behavior

Bootstrapping works properly.

Screenshots and recordings

No response

OS / Distro

Ubuntu 20.04.3

Flux version

0.17

Flux check

► checking prerequisites
✔ kubectl 1.20.2 >=1.18.0-0
✔ Kubernetes 1.21.1 >=1.16.0-0
► checking controllers
✔ helm-controller: deployment ready
► ghcr.io/fluxcd/helm-controller:v0.11.2
✔ kustomize-controller: deployment ready
► ghcr.io/fluxcd/kustomize-controller:v0.14.0
✔ notification-controller: deployment ready
► ghcr.io/fluxcd/notification-controller:v0.16.0
✔ source-controller: deployment ready
► ghcr.io/fluxcd/source-controller:v0.15.4
✔ all checks passed

Git provider

No response

Container Registry provider

No response

Additional context

Discussion on Slack

Code of Conduct

• I agree to follow this project's Code of Conduct

[kingdonb]

Max raised this issue yesterday via Slack and when we looked into it, we found that go-git was not configured to use the CA cert, but apparently could be. He is working on a PR to make this possible as a bootstrap-time configuration, this should fix another edge case where certain configurations cannot use bootstrap. 💯

Thanks for looking into this @makkes