From f199724b0a82c438ca0bfa352ac46c618689de1d Mon Sep 17 00:00:00 2001
From: Admin Bot <admin@riotpiao.com>
Date: Wed, 26 Aug 2026 16:09:35 -0700
Subject: [PATCH] fix: copy CA certs into distroless image for k8s API TLS

---
 Dockerfile | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/Dockerfile b/Dockerfile
index 5d7d6e7..e91900a 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -46,6 +46,10 @@ FROM gcr.io/distroless/static-debian12:nonroot
 # securityContext; if one changes, both must.
 USER 65532:65532
 
+# distroless/static has no CA certs. Copy them from the build stage so Go's
+# crypto/tls can verify the Kubernetes API server certificate.
+COPY --from=build /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
+
 COPY --from=build /out/gateway /gateway
 
 EXPOSE 8080