fix: copy CA certs into distroless image for k8s API TLS

2026-08-26 16:09:35 -07:00
parent 3408c7b053
commit f199724b0a
1 changed files with 4 additions and 0 deletions
@@ -46,6 +46,10 @@ FROM gcr.io/distroless/static-debian12:nonroot
 # securityContext; if one changes, both must.
 USER 65532:65532

+# distroless/static has no CA certs. Copy them from the build stage so Go's
+# crypto/tls can verify the Kubernetes API server certificate.
+COPY --from=build /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
+
 COPY --from=build /out/gateway /gateway

 EXPOSE 8080