Set the chart's placeholder version to 0.29.1

Cosmetic: make helm-package sets the published version and appVersion from the tag, so these two fields decide nothing (see the comment above them). Kept in step anyway, same as 155f27c and c5be55d, so a tree heading for v0.29.1 doesn't say 0.29.0.
Ship a CA bundle in the image so single sign-on can reach the provider
2026-09-26 22:05:33 +02:00 · 2026-09-26 22:05:33 +02:00
2 changed files with 8 additions and 2 deletions
@@ -16,6 +16,12 @@ RUN CGO_ENABLED=0 GOOS=${TARGETOS} GOARCH=${TARGETARCH} \
    go build -ldflags="-w -s -X main.version=${VERSION}" -o /terdut ./cmd/terdut

 FROM scratch
+# scratch has no trust store, and a Go binary on it fails every HTTPS call with
+# "x509: certificate signed by unknown authority". Nothing needed one until single
+# sign-on: discovery and the token exchange are HTTPS calls to the identity provider.
+# The bundle is the builder's, copied by name so a missing file fails the build
+# rather than shipping an image that cannot sign anybody in.
+COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
 COPY --from=builder /terdut /terdut
 EXPOSE 8080
 ENTRYPOINT ["/terdut"]
@@ -15,5 +15,5 @@ type: application
 # appVersion and image.tag in values.yaml no longer agree, and that is not an oversight:
 # image.tag stays "latest", which is what a local install actually pulls. appVersion is
 # metadata and drives nothing.
-version: 0.29.0
-appVersion: "v0.29.0"
+version: 0.29.1
+appVersion: "v0.29.1"