kubernetes.yaml

---
apiVersion: v1
kind: ConfigMap
metadata:
  name: setup-script
  namespace: kube-system
data:
  setup.sh: |
    echo "$TRUSTED_CERT" > /etc/ssl/certs/registry.crt && update-ca-certificates && systemctl restart containerd
---
apiVersion: apps/v1
kind: DaemonSet
metadata:
  namespace: kube-system
  name: certs-setup
  labels:
    app: certs-setup
spec:
  selector:
    matchLabels:
      app: certs-setup
  template:
    metadata:
      labels:
        app: certs-setup
    spec:
      hostPID: true
      hostNetwork: true
      initContainers:
      - name: init-node
        command: ["nsenter"]
        args: ["--target", "1", "--mount", "--", "sh", "-c", "$(SETUP_SCRIPT)"]
        image: debian
        volumeMounts:
        - name: registry-cert
          mountPath: /tmp/registry
        env:
        - name: TRUSTED_CERT
          valueFrom:
            secretKeyRef:
              name: certs-secret
              key: tls.crt
        - name: SETUP_SCRIPT
          valueFrom:
            configMapKeyRef:
              name: setup-script
              key: setup.sh
        securityContext:
          privileged: true
      volumes:
      - name: registry-cert
        secret:
          secretName: certs-secret
      containers:
      - name: wait
        image: gcr.io/google-containers/pause:3.2