bump: go-utils 0.30.1 fixes trivy scans

changelog/v1.22.0-beta11/bump-go-utils-0.30.1.yaml

@@ -0,0 +1,21 @@
+changelog:
+  - type: DEPENDENCY_BUMP
+    resolvesIssue: false
+    description: >-
+      Bump go-utils to v0.30.1 so Trivy scan templates use the required .tpl
+      extension and remain compatible with Trivy v0.70.0 and later.
+    dependencyOwner: solo-io
+    dependencyRepo: go-utils
+    dependencyTag: v0.30.1
+  - type: NON_USER_FACING
+    resolvesIssue: false
+    description: >-
+      Download the envtest binaries once during install-go-tools so the parallel
+      projects/gateway2 test packages no longer race to populate the shared
+      setup-envtest store.
+  - type: NON_USER_FACING
+    resolvesIssue: false
+    description: >-
+      Regenerate the nginx test certificate embedded in nginx_pod.yaml, which
+      expired on 2026-08-07 and broke the client_tls e2e suite with
+      CERTIFICATE_VERIFY_FAILED. The replacement is valid until 2048.

go.mod

@@ -1,6 +1,6 @@
 module github.com/solo-io/gloo
 
-go 1.26.4
+go 1.26.5
 
 require (
 	github.com/Masterminds/semver/v3 v3.4.0
@@ -45,7 +45,7 @@ require (
 	github.com/saiskee/gettercheck v0.0.0-20210820204958-38443d06ebe0
 	github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3
 	github.com/solo-io/go-list-licenses v0.1.4
-	github.com/solo-io/go-utils v0.30.0
+	github.com/solo-io/go-utils v0.30.1
 	github.com/solo-io/k8s-utils v0.13.0
 	github.com/solo-io/protoc-gen-ext v0.1.0
 	github.com/solo-io/protoc-gen-openapi v0.4.0

go.sum

@@ -2832,8 +2832,8 @@ github.com/solo-io/cue v0.4.7/go.mod h1:P1tN9y6nBPAMoEK5aJxI8kn0VUcjVcRc+8esieRz
 github.com/solo-io/go-list-licenses v0.1.4 h1:u4xh1OUORT4iSWuAp3Q4NsfHcDaeUV8QRDH8ACQqbxw=
 github.com/solo-io/go-list-licenses v0.1.4/go.mod h1:x6LSp/NrYgVXwNum7ZOiaAYTpg6B3F6TrWYfcdHVroA=
 github.com/solo-io/go-utils v0.20.2/go.mod h1:6e8K1spnMWwlnJRSNp/J84GEyJbrcK4Gm7i+ehzCi8c=
-github.com/solo-io/go-utils v0.30.0 h1:+6BvtONijPXQLKGKMrmQ4KFkbXMPW3F39fcDkr66B20=
-github.com/solo-io/go-utils v0.30.0/go.mod h1:O3IvNQlI2WoZW2+4uLtaHBRBE8PCboOiGKm5PId7wTA=
+github.com/solo-io/go-utils v0.30.1 h1:63MAsIZNOnyqWb2EKsnjNpDluq11ncKtqiXVo1zhwjQ=
+github.com/solo-io/go-utils v0.30.1/go.mod h1:UT3UnFFKiapOmdG2zdIbSY3y1k37Cf4oBl8Ev14+QcU=
 github.com/solo-io/k8s-utils v0.13.0 h1:mQ0NUdu4aUpxHAKWIzlBvhCxJ97ojuX+Y5CxLNz8gH4=
 github.com/solo-io/k8s-utils v0.13.0/go.mod h1:EuxoLFcysa3D6CoUoR3VyeJCsdd0PAKIZF3Qobw7Aa4=
 github.com/solo-io/protoc-gen-ext v0.1.0 h1:WvmXaontRCax9Wq5vAdewv+4tCwTrubC5rbk6coSajQ=

projects/gateway2/Makefile

@@ -27,6 +27,16 @@ ENVTEST_K8S_VERSION = 1.31
 envtest-path:
 	@$(ENVTEST) use $(ENVTEST_K8S_VERSION) -p path --arch=amd64
 
+# Populates the shared setup-envtest store ahead of the test run.
+# The test packages under projects/gateway2 run in parallel and each shell out to
+# envtest-path, so against a cold store they race to unpack the same
+# version-platform directory: setup-envtest wipes that directory before extracting,
+# so one process deletes the binaries out from under the other. Once the version is
+# on disk, envtest-path resolves it locally and no longer writes to the store.
+.PHONY: envtest-download
+envtest-download:
+	@$(ENVTEST) use $(ENVTEST_K8S_VERSION) --arch=amd64 -p path > /dev/null
+
 ENVTEST = $(DEPSGOBIN)/setup-envtest
 
 DEPSGOBIN:=$(shell pwd)/.bin
@@ -36,3 +46,4 @@ export GOBIN:=$(DEPSGOBIN)
 install-go-tools:
 	mkdir -p $(DEPSGOBIN)
 	test -s $(ENVTEST) || go install sigs.k8s.io/controller-runtime/tools/setup-envtest@e4c1c38bcbdb
+	$(MAKE) envtest-download

test/kubernetes/e2e/defaults/testdata/nginx_pod.yaml

@@ -56,9 +56,22 @@ metadata:
   name: nginx-tls
   namespace: nginx
 data:
-  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURFakNDQWZxZ0F3SUJBZ0lVQVU0UytibjdaUm42ZEhja3JqRUJZOWZUVzJrd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0ZERVNNQkFHQTFVRUF3d0piRzlqWVd4b2IzTjBNQjRYRFRJMU1EZ3dOekUwTWpBeE4xb1hEVEkyTURndwpOekUwTWpBeE4xb3dGREVTTUJBR0ExVUVBd3dKYkc5allXeG9iM04wTUlJQklqQU5CZ2txaGtpRzl3MEJBUUVGCkFBT0NBUThBTUlJQkNnS0NBUUVBc1NFOTF2U0pZdWcvcWs1V3ZuN2JDcUhheWN1UU1WZnRzN1Z1dFQ0OWRLV24KOXFVZGxsL2JrWjVUNkllenlnNUdxSUxSK1YvNnhFRWl4WlJHWHlnMi85RUd4UHdycVVnM2pxZ25DUTdaTVp5VwphdWltak9OMG85NWtpNWZOaVJUMkprdmIyVW5BQW53aXdTQ1A0QnQ5cTFjenIxNnE3cVdyNURrQVdOb1czTmVxClRXYURQZEMzOEFOUWw0YnVGMGRzMkhOYVk0Ty9FeWxhSW9JSmZtNC9ucVBGdmlpUUJ5S1cxMlB5Z3duaVZIdnUKNk1JMVQxV3hDYWI1ckt1dEZYZ2ZxRFA5dHBra1plV1B5c3lSV2ZxOFR4aTdhZXNwZSs2Vk5RTTNtSzBMMmo4ZgpkZ0NkZWs2VUFQdFRQb3Q1bjNCR0FvTTVZcVRFRWFVK2xEZjVPMEpMbVFJREFRQUJvMXd3V2pCWUJnTlZIUkVFClVUQlBnZ2xzYjJOaGJHaHZjM1NDQlc1bmFXNTRnZ3R1WjJsdWVDNXVaMmx1ZUlJUGJtZHBibmd1Ym1kcGJuZ3UKYzNaamdoMXVaMmx1ZUM1dVoybHVlQzV6ZG1NdVkyeDFjM1JsY2k1c2IyTmhiREFOQmdrcWhraUc5dzBCQVFzRgpBQU9DQVFFQUNaa05sclJmMnlvbEJJK1R6VjBvcEE1Z00wRkJyUmhYUEswMXNPa1laaFVUMnZLQjBYK3ViWVM1ClRJSE51NUdnQWJ4eTFsMDV2Zjk3LzFKUkxQSHJDcUdJOUhtYllFTFBkLzhGNmlGOUJNTVJaVXZ1ZHZnOGt2by8KaHRwR3hrVlJxcUJxa29nZlhLak1DbFRuY0p4M0VCYzB4TWxqOVRieHFjS0JITEdBcG1XVDNvcmtYN0krRkZ5ZQpMV0dVbUpJRUhGeHgwSDRrYTZwVE5jS1JVZkN6QUh1a0lkMStMNEdsMk81blA3dzlXME1sZTNjSWJzRE44bTdyCmRYb3dPUDdXWHpGUCtiRUlWcjJJekcvcjBiQkRzRUJ1dUdRZ2ZiZHo5TXY0NUdGUXBRTlREK1lyK3h1N2xmamUKOFltczdNUkpIZVVabnpnS3hodnVqRUJacVdmS2RRPT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=
-  tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JSUV2UUlCQURBTkJna3Foa2lHOXcwQkFRRUZBQVNDQktjd2dnU2pBZ0VBQW9JQkFRQ3hJVDNXOUlsaTZEK3EKVGxhK2Z0c0tvZHJKeTVBeFYrMnp0VzYxUGoxMHBhZjJwUjJXWDl1Um5sUG9oN1BLRGthb2d0SDVYL3JFUVNMRgpsRVpmS0RiLzBRYkUvQ3VwU0RlT3FDY0pEdGt4bkpacTZLYU00M1NqM21TTGw4MkpGUFltUzl2WlNjQUNmQ0xCCklJL2dHMzJyVnpPdlhxcnVwYXZrT1FCWTJoYmMxNnBOWm9NOTBMZndBMUNYaHU0WFIyelljMXBqZzc4VEtWb2kKZ2dsK2JqK2VvOFcrS0pBSElwYlhZL0tEQ2VKVWUrN293alZQVmJFSnB2bXNxNjBWZUIrb00vMjJtU1JsNVkvSwp6SkZaK3J4UEdMdHA2eWw3N3BVMUF6ZVlyUXZhUHg5MkFKMTZUcFFBKzFNK2kzbWZjRVlDZ3psaXBNUVJwVDZVCk4vazdRa3VaQWdNQkFBRUNnZ0VBZFFkbGVEUXc0V3haUkFobVA0NUk0b2wxcUlZYVNyK3hpVjZDT3JWWW5VMGwKNEV2UGRKNzR6d2t3bngycHFBSXVwUDlxQTcxcVRXaEx0UWIyUjhDbU5mYkE1ajFHQzU1dk5vM2EzSjAyMnhSKwpQVHhoYmd5SjhBcnJtMTg4cVNsMFNIRXVYQzNoOHNKWnBBZ0RoeW9pcWFYL3ZBcHNIU2pRblFVY09aZytLc0lvCjltNEhIczRzQUxBWGxlYS9TaWlIKzNReGF3aGRNZ1l5enhEVGZEbUpuUVM1MkE5eG1BaklFdGdRQlJRa2x1N1MKM1ZVTkM0clUxSU1ZVFo5dmlXcVlJd0U4Y2Q0aXNJNkQ3SHJZYTVwaEtTYmhMNmxVKy9oMHIwMW52VWhFdXp0SgpyREhCOVpjK2FHbU4zc2UxS0ZHSTZXWkgyOE85bnhrMlErY2htQ3l0RVFLQmdRRGozMlF3NEpsNHk4U1ZzUjFlCkYzSWVMVDVwS0JKYnkyeUVDaytCZ290dDl2VnMrTlFJdTRKYUNVZ3JZampBOHBKNGRMYmNXUDF4RmFibHhyRy8KRGRFc0cxVkt0a2FwdUJrUzl3bG5BZ21GNWRmSzdjOUZFc1VDL2N6WURwdmFpbUZQd2VzenN5QWkrVHQrZkdlRQpGYk8xZDVMbkt1dGE4NStGMEZ4VjhCdW51d0tCZ1FERy9tcGtRdThsNUNmaU1WMmk2Y1VTU3dhRHBjSVRvOXFhCi9RRFVZelBJT2tSaDZ4Y0lDeDhFMnBnbmljc3ZSUlpjaUhvL1FKcHEyekZubG5oVG51d0ZVeWlJMXloaGVoSkYKMld2M1k2SEZhMCtXZ2xaZlRvWnZ6dEJEUFVGYWlQcUVEYkZqbGZ3Rm5tUzR4NWdUYmg5UXZuK09NL2RvOVdaOApONVowcjREeXV3S0JnRHp0ZHdtR2xDSnpRVTNRL0l3eThxVlU3WklLVDlaUmJ1TmpLbHp6ZmJwYVJNYnRSU3hNCmpvN3FXbXlYSjV1WGdFaEsxTFhYNlhQNkdSVG82byt0N3hhKy9EQXN5bm9JcWxPaXo5WEYrcXZkaDdSUG41TFYKY08zYTFKR1VYbUd4akZGYUJUeGVrYUlvUjVzTFFsWlR3eWdySDVGRnJZWTFDNXNvMmZkMGFzQ1BBb0dBVDJVSwp4ZDMrMUx0blBsUTc2OWdoak43cVJuUklMdFhkVHFGTFIzSWRJdkk4Zm1UeDEzKzRiSk5heWN1c2lidWk1R0IvCmhlVWN0eTJsVkpNd2h3eU5Wc0tMRmEzaXFxR3QwTGlpM3gyZFdjc3JBZjRXd0Fmd2s0T01qSWRRSC9NdklLamwKOGJuUng5d2VpNnIyL2ltZHpQVjBweVFNdm8vS3lCelZwdEN2UGlrQ2dZRUF0NFJ1SG5BY0pQN2dnRFcyeDVYVApjOTdhWVVIcGoreHdwOWsyWmhjMUVtTGVoWlVxakk4c3RTYlYvZmtkSGN2RTFpSCtRVjJ3emkxRjBXRm9ZK0JMCmgvY0ZNd3d5bTV6U1FmbStza2I3N0R3RG93MStxbW5iaWdsYkJuelpTVjhBSFRXTUFBcm8vRWRacmJRZVh5NnIKTnJVMmJ0RElHNU54Y1B6VXZISDhnZnM9Ci0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0K
-  ca.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURFakNDQWZxZ0F3SUJBZ0lVQVU0UytibjdaUm42ZEhja3JqRUJZOWZUVzJrd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0ZERVNNQkFHQTFVRUF3d0piRzlqWVd4b2IzTjBNQjRYRFRJMU1EZ3dOekUwTWpBeE4xb1hEVEkyTURndwpOekUwTWpBeE4xb3dGREVTTUJBR0ExVUVBd3dKYkc5allXeG9iM04wTUlJQklqQU5CZ2txaGtpRzl3MEJBUUVGCkFBT0NBUThBTUlJQkNnS0NBUUVBc1NFOTF2U0pZdWcvcWs1V3ZuN2JDcUhheWN1UU1WZnRzN1Z1dFQ0OWRLV24KOXFVZGxsL2JrWjVUNkllenlnNUdxSUxSK1YvNnhFRWl4WlJHWHlnMi85RUd4UHdycVVnM2pxZ25DUTdaTVp5VwphdWltak9OMG85NWtpNWZOaVJUMkprdmIyVW5BQW53aXdTQ1A0QnQ5cTFjenIxNnE3cVdyNURrQVdOb1czTmVxClRXYURQZEMzOEFOUWw0YnVGMGRzMkhOYVk0Ty9FeWxhSW9JSmZtNC9ucVBGdmlpUUJ5S1cxMlB5Z3duaVZIdnUKNk1JMVQxV3hDYWI1ckt1dEZYZ2ZxRFA5dHBra1plV1B5c3lSV2ZxOFR4aTdhZXNwZSs2Vk5RTTNtSzBMMmo4ZgpkZ0NkZWs2VUFQdFRQb3Q1bjNCR0FvTTVZcVRFRWFVK2xEZjVPMEpMbVFJREFRQUJvMXd3V2pCWUJnTlZIUkVFClVUQlBnZ2xzYjJOaGJHaHZjM1NDQlc1bmFXNTRnZ3R1WjJsdWVDNXVaMmx1ZUlJUGJtZHBibmd1Ym1kcGJuZ3UKYzNaamdoMXVaMmx1ZUM1dVoybHVlQzV6ZG1NdVkyeDFjM1JsY2k1c2IyTmhiREFOQmdrcWhraUc5dzBCQVFzRgpBQU9DQVFFQUNaa05sclJmMnlvbEJJK1R6VjBvcEE1Z00wRkJyUmhYUEswMXNPa1laaFVUMnZLQjBYK3ViWVM1ClRJSE51NUdnQWJ4eTFsMDV2Zjk3LzFKUkxQSHJDcUdJOUhtYllFTFBkLzhGNmlGOUJNTVJaVXZ1ZHZnOGt2by8KaHRwR3hrVlJxcUJxa29nZlhLak1DbFRuY0p4M0VCYzB4TWxqOVRieHFjS0JITEdBcG1XVDNvcmtYN0krRkZ5ZQpMV0dVbUpJRUhGeHgwSDRrYTZwVE5jS1JVZkN6QUh1a0lkMStMNEdsMk81blA3dzlXME1sZTNjSWJzRE44bTdyCmRYb3dPUDdXWHpGUCtiRUlWcjJJekcvcjBiQkRzRUJ1dUdRZ2ZiZHo5TXY0NUdGUXBRTlREK1lyK3h1N2xmamUKOFltczdNUkpIZVVabnpnS3hodnVqRUJacVdmS2RRPT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=
+  # Self-signed cert used both as nginx's server cert (tls.crt/tls.key) and as the
+  # trust root Envoy verifies it against (ca.crt), so ca.crt is a copy of tls.crt.
+  # Valid Aug 1 2026 - Aug 1 2048. Give any replacement a similarly long lifetime:
+  # a short-lived cert silently breaks the client_tls suite on expiry, not on merge.
+  # To regenerate (the SANs must keep matching server_name in nginx.conf above, and
+  # must not match the verifySubjectAltName in the client_tls nginx-oneway-bad-san
+  # Upstream, which asserts that SAN verification actually rejects a mismatch):
+  #
+  #   openssl req -x509 -nodes -newkey rsa:2048 -keyout tls.key -out tls.crt \
+  #     -days 8000 -subj "/CN=localhost" \
+  #     -addext "subjectAltName=DNS:localhost,DNS:nginx,DNS:nginx.nginx,DNS:nginx.nginx.svc,DNS:nginx.nginx.svc.cluster.local"
+  #
+  # then base64 tls.crt into both tls.crt and ca.crt, and base64 tls.key into tls.key.
+  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURFakNDQWZxZ0F3SUJBZ0lVRnRyUEg5YWlOUkZ6RCtmWFdrSmV1MlJtQjZVd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0ZERVNNQkFHQTFVRUF3d0piRzlqWVd4b2IzTjBNQjRYRFRJMk1EZ3dNVEF3TURBd01Gb1hEVFE0TURndwpNVEF3TURBd01Gb3dGREVTTUJBR0ExVUVBd3dKYkc5allXeG9iM04wTUlJQklqQU5CZ2txaGtpRzl3MEJBUUVGCkFBT0NBUThBTUlJQkNnS0NBUUVBbjBqQ2kwSkVrL0ZTaFRldldyL1F0NitqeUNZbUZZakwxRko1T2NPaGhwdTIKVGJ6STU1M2JwMjlPWUpYdVdBQ1k1aTNnaWNCNytlR2UyN1pLd2hndkREa0Riemt6aFFhVUV2SW5VQ1QzQzc4QQpxYktPc0JNRDU0YTdJWWxDaHY0S1pmVExrK2p3L2duRXhTb3ZyM0tWdmxkZnRQLy9FTnUxZHFyeVYrYjVIQlNMClVSaWJGQkNwdmpMYnFEdjc3aHduRVNoenh4dllOT3prZG5nUzB0R2tUa0NxMVptS09XQlJsSGcwaXBaOWZJSFkKQnU2NjBGVUpJY0FtbEJadFRyYU1IT0tzTDhuLzdFNDl6VGljOEo4Zm8vdTBzdXVJdmNXa3ZxRklIWmRjc1dUSwpUdlpXYTl2YVgvaXlNZldRaVlsTllhYWhyR1RiUEFDYmlheFlvc1BISndJREFRQUJvMXd3V2pCWUJnTlZIUkVFClVUQlBnZ2xzYjJOaGJHaHZjM1NDQlc1bmFXNTRnZ3R1WjJsdWVDNXVaMmx1ZUlJUGJtZHBibmd1Ym1kcGJuZ3UKYzNaamdoMXVaMmx1ZUM1dVoybHVlQzV6ZG1NdVkyeDFjM1JsY2k1c2IyTmhiREFOQmdrcWhraUc5dzBCQVFzRgpBQU9DQVFFQUsyZHhtRVFtL2ZnUllBZTJZVU5ua1VCRmRxVkdON21Sb01adUVaMkRzQmtvSXBkZUFGb3FFMStLCkd5UWczZGFIQU94dzRISXA1M2g5cW8xbWFxOCtQSzZxQlVxcDZ3amxTMHRYVm1jbHY4YjVHcHBsRkRrSHNHeFQKUVppR2lXRmFOU3pWOGJlcnhsMzhmZDkxWCswY3VEd2JucE02OWN2S0QzL01WL1dwNEtjTjlPaytZc2Y4VU9hZwpOTXBjVHFNUlhwSlZPMkg2YUQxM2ZlbnhneTFuaXJnRUVWcm4xRC84eWZ5c1VGdDFOcXZndDM5R25ucS9OOTV0ClB5akNhNjhITUthWktsR0ZPVGI2MDlVbVFvQlgxMzZnY0prWXJVNFhHSG1uSnJLMll2Y1B0TDVLMW5LQ2RMcFcKR0ZmTmZFWnF3eEdSdFhacXFxL2dKaVBMOVhpajZnPT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=
+  tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JSUV2d0lCQURBTkJna3Foa2lHOXcwQkFRRUZBQVNDQktrd2dnU2xBZ0VBQW9JQkFRQ2ZTTUtMUWtTVDhWS0YKTjY5YXY5QzNyNlBJSmlZVmlNdlVVbms1dzZHR203Wk52TWpubmR1bmIwNWdsZTVZQUpqbUxlQ0p3SHY1NFo3Ygp0a3JDR0M4TU9RTnZPVE9GQnBRUzhpZFFKUGNMdndDcHNvNndFd1BuaHJzaGlVS0cvZ3BsOU11VDZQRCtDY1RGCktpK3ZjcFcrVjErMC8vOFEyN1YycXZKWDV2a2NGSXRSR0pzVUVLbStNdHVvTy92dUhDY1JLSFBIRzlnMDdPUjIKZUJMUzBhUk9RS3JWbVlvNVlGR1VlRFNLbG4xOGdkZ0c3cnJRVlFraHdDYVVGbTFPdG93YzRxd3Z5Zi9zVGozTgpPSnp3bngrais3U3k2NGk5eGFTK29VZ2RsMXl4Wk1wTzlsWnIyOXBmK0xJeDlaQ0ppVTFocHFHc1pOczhBSnVKCnJGaWl3OGNuQWdNQkFBRUNnZ0VBT3R1dkQ3aUFFTTcydUVWWVpjZEZmK3JHTVpwdkxqdnJYZHpQOE5scVlZdysKZEVGVFY4c01OTFc3bDVNdmpKTkQ3S0o5TzBuR1JoTHFHYlFsc2MwdjdXdFA2cFNQaGhObE9nOERHZWxlNUpkQwp6bkl0cWNDTkM4dk1jRnNCRzFMYVVzeC9RWHV0T2FJd2RNN2U2ZzBFYWw1cy9qd3VhM05VZmJJemRPbmptVTBrCk1RSk0vTndORDZkSi9DYVF5RDBOc0VxM0d1UHoxRko4ZGhIR1ZJRjRBbEwxczdEbUJha1BPZWRETXdBdEhmV1IKeUxUaHR3WmxIUVFkbWdKT1dqNlBiUGlCMCtmK1pHaWVSK1AvT0JHbnRYc1c4L0ZQVkZFTkx1dE54OGVZTVZHRApZUlRBN3J2QjBBRWNQRlo2VFlNL3FCb1g0SG52NHE3cnJhUEVsaEhrY1FLQmdRRGVoVStxL3I2MFdONTgveDU3Cm02TlFnYXNqR1NvZ3hSL2gzVjZUUHBQdHFZYzhvajUzNGk5YmxKSklkUitVcWM3OERFdjJ6SkpZaDJDMGZrcEMKOGM5eWZRckszREJscmttRis3RzZaZGZ2V291dzV6OVdWTkFJSVRRSnVkcWJXUmpJSFZlbFRwVTZpZE9jakR6MApxN20vQ0ZiT1FQdm5ZVEhFaFN6amh1Lzh5UUtCZ1FDM1A4N1dKcFVUUXlPVDFCb2VoVUhiMGozZEFSWFBKOFFmClJZTHpoOFR4cEpPZ3hBdmkvSjRJMjlzcm1rdjZva2FkTkh2OGlnM3U4bXJBQzZ2Z3A4eS85eVBZbkpMNHBmd2wKN3AyWEtMTnNUQ2dOaC81bnh0dTlNZ0kvRUxWQ3ViRUNCMnN3ZXZCaE1keEV0SUNtT2VrckFqZ2k0eERwcUZxdQpWWWYyL0ozTWJ3S0JnUUN6bEc2NUZ5R2N0bVBJQ0xQM0dhSHhaTlJTWFFxc3E2bVJSSEFBOE8yOVRhV0FmNGRlCmhNR25iUDJwVUN5T2M0UkIwVUsxQ0YvSzVtWmJBOWkyc2lPeXg4c2Y4QmQyMS9NcUYvaFU3OEFXd01JZm9HQnoKTWJzNTlHSGt2NEwzQUM2SndYUnNTa0VRbnc2U05uTXpHaXVyU2ZXVU9zbVE3OVdVUGMzK1NYWUFVUUtCZ1FDQwplOU1DTmxMc2RtQTlBVWpmOXE5Z29hSWZYb2h6QzdQaE9KUDRhUExaeGdEQTl4Z250dzJvN1RSeEpkdDRTbGpSCjArOTljYWhlUHd1NFdCYzVUd0xDcG01RjdhZlJtZytqeXZjNERXbEZjaTBMQlkwbnhEZnZ6azQvTGR5RCtNbUwKMGxDSEl1TkxzajlRUk45ZWZkb0VILzV0Q1JhZjZwczNpL3ZXNlNaTHpRS0JnUUMwZENyWkRwTlZZV0doTGFTSQpzOGpIVndKZjFyMGk5WllaMEw5YTFhc3BGOEFzaGxsczNFWTc0dER5NmN0Nlo2YTVQY1VYQnlUck4vcVFRSHBCCmdhd1lwWW9DWjNSR3dKUzlCbVNITDFYMUpySzFFVXJ5d3hUK1RlSlFnVXRMbFkyaW40M25jNUNOUWEyRDBuV0UKV1h6MzJDNTF2aHJaMlpYZ0hWTWxjSDVLWWc9PQotLS0tLUVORCBQUklWQVRFIEtFWS0tLS0tCg==
+  ca.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURFakNDQWZxZ0F3SUJBZ0lVRnRyUEg5YWlOUkZ6RCtmWFdrSmV1MlJtQjZVd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0ZERVNNQkFHQTFVRUF3d0piRzlqWVd4b2IzTjBNQjRYRFRJMk1EZ3dNVEF3TURBd01Gb1hEVFE0TURndwpNVEF3TURBd01Gb3dGREVTTUJBR0ExVUVBd3dKYkc5allXeG9iM04wTUlJQklqQU5CZ2txaGtpRzl3MEJBUUVGCkFBT0NBUThBTUlJQkNnS0NBUUVBbjBqQ2kwSkVrL0ZTaFRldldyL1F0NitqeUNZbUZZakwxRko1T2NPaGhwdTIKVGJ6STU1M2JwMjlPWUpYdVdBQ1k1aTNnaWNCNytlR2UyN1pLd2hndkREa0Riemt6aFFhVUV2SW5VQ1QzQzc4QQpxYktPc0JNRDU0YTdJWWxDaHY0S1pmVExrK2p3L2duRXhTb3ZyM0tWdmxkZnRQLy9FTnUxZHFyeVYrYjVIQlNMClVSaWJGQkNwdmpMYnFEdjc3aHduRVNoenh4dllOT3prZG5nUzB0R2tUa0NxMVptS09XQlJsSGcwaXBaOWZJSFkKQnU2NjBGVUpJY0FtbEJadFRyYU1IT0tzTDhuLzdFNDl6VGljOEo4Zm8vdTBzdXVJdmNXa3ZxRklIWmRjc1dUSwpUdlpXYTl2YVgvaXlNZldRaVlsTllhYWhyR1RiUEFDYmlheFlvc1BISndJREFRQUJvMXd3V2pCWUJnTlZIUkVFClVUQlBnZ2xzYjJOaGJHaHZjM1NDQlc1bmFXNTRnZ3R1WjJsdWVDNXVaMmx1ZUlJUGJtZHBibmd1Ym1kcGJuZ3UKYzNaamdoMXVaMmx1ZUM1dVoybHVlQzV6ZG1NdVkyeDFjM1JsY2k1c2IyTmhiREFOQmdrcWhraUc5dzBCQVFzRgpBQU9DQVFFQUsyZHhtRVFtL2ZnUllBZTJZVU5ua1VCRmRxVkdON21Sb01adUVaMkRzQmtvSXBkZUFGb3FFMStLCkd5UWczZGFIQU94dzRISXA1M2g5cW8xbWFxOCtQSzZxQlVxcDZ3amxTMHRYVm1jbHY4YjVHcHBsRkRrSHNHeFQKUVppR2lXRmFOU3pWOGJlcnhsMzhmZDkxWCswY3VEd2JucE02OWN2S0QzL01WL1dwNEtjTjlPaytZc2Y4VU9hZwpOTXBjVHFNUlhwSlZPMkg2YUQxM2ZlbnhneTFuaXJnRUVWcm4xRC84eWZ5c1VGdDFOcXZndDM5R25ucS9OOTV0ClB5akNhNjhITUthWktsR0ZPVGI2MDlVbVFvQlgxMzZnY0prWXJVNFhHSG1uSnJLMll2Y1B0TDVLMW5LQ2RMcFcKR0ZmTmZFWnF3eEdSdFhacXFxL2dKaVBMOVhpajZnPT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=
 ---
 apiVersion: v1
 kind: Pod