Publish the registry CA to the jenkins namespace

Node trust covers image pulls, which containerd performs on the node. A
docker push from a build pod is a different client with its own trust
store and knows nothing about that, so without this a push fails TLS
verification while a pull of the same image succeeds — which reads like a
broken registry rather than a missing trust anchor.

Committed in the clear rather than routed through Vault: this is the CA's
public half, the same certificate every node already fetches from Secret
Manager. The private key stays in Terraform state and reaches the cluster
only as the cert-manager Secret that signs.

Consumers mount it at
/etc/docker/certs.d/harbor.35.238.248.203.nip.io/ca.crt — the directory
name must be the registry hostname exactly, since dockerd looks the path
up by host and a mismatch silently does nothing. First consumer is the
base-images mirror pod; devops-lib-gcp's build pod follows.

Verified the embedded PEM round-trips: its SHA-256 fingerprint matches
terraform output registry_ca_cert_pem exactly.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LEsTefWWifp4ikvhHF5s6N

extra-manifests/registry-ca-configmap.yaml

@@ -0,0 +1,67 @@
+# The registry CA's PUBLIC certificate, for Docker clients that push to
+# Harbor from inside the cluster.
+#
+# Not a secret, which is why it is committed here in plain sight rather than
+# going through Vault: it is the same certificate every node already fetches
+# from Secret Manager, and publishing a CA's public half is what a CA is for.
+# The private key is a different matter entirely — it exists only in
+# Terraform state and reaches the cluster as the `registry-ca` Secret in the
+# cert-manager namespace, which cert-manager uses to sign.
+#
+# Why this exists at all: the node pool trusting the CA covers image PULLS,
+# performed by containerd on the node. A `docker push` from a build pod is a
+# separate client with its own trust store, and it has no idea the node
+# trusts anything. Without this, pushes fail TLS verification while pulls of
+# the very same image work — which reads like a broken registry rather than a
+# missing trust anchor.
+#
+# Mount it in whichever container runs dockerd, at
+#   /etc/docker/certs.d/harbor.35.238.248.203.nip.io/ca.crt
+# The directory name must be the registry hostname exactly; dockerd looks the
+# path up by host, so a mismatch silently does nothing. Consumers so far: the
+# base-images mirror pod (devops-base-images-gcp) and devops-lib-gcp's build
+# pod template.
+#
+# The homelab needs none of this — its Harbor is plain HTTP and its dind
+# passes --insecure-registry instead.
+#
+# If the CA is ever regenerated in Terraform, this file must be updated to
+# match, along with the cert-manager Secret and the node pool's Secret
+# Manager version.
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: registry-ca
+  namespace: jenkins
+data:
+  ca.crt: |
+    -----BEGIN CERTIFICATE-----
+    MIIFMTCCAxmgAwIBAgIRAPf5gf3756sdf3nlZBTnlREwDQYJKoZIhvcNAQELBQAw
+    MjERMA8GA1UEChMIdG9vbHNoZWQxHTAbBgNVBAMTFHRvb2xzaGVkLXJlZ2lzdHJ5
+    LWNhMB4XDTI2MDkxMTA0MDIxNloXDTM2MDkwODA0MDIxNlowMjERMA8GA1UEChMI
+    dG9vbHNoZWQxHTAbBgNVBAMTFHRvb2xzaGVkLXJlZ2lzdHJ5LWNhMIICIjANBgkq
+    hkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA5GS3vpS2iG+Gl9YQx/NwlIXfMLhKVfDM
+    YixjPzYQv93Md9iR8c7CDFPijw8kf7200L7Z6Cp4hrCseL7QZZyvGnrmAt8lfhmz
+    Fj1Q9RP/WbKam2GHXanz3sWQ7XtUQiEg0yHkBchglgHQYQhdbePMi3zXPx8KPhis
+    QcNtOAAsLdisIaCz+NrA8qgPMel9LcdZTejaxhBRkOGPHO47xDslNl2JBnermbLc
+    XqWMh1exyWcscylaE8/e8brufRGWAXMfA+JElDH92VLIGaTQwI2KcTFr9SM7UwYN
+    tdcggT3BzPOmV/DaICJu+81RplZiEj+rU6ZQ1rwYUMPcEelWaDjL5e+27z5bFTJk
+    JCGc2x4HjfwD65961d0Mn/BqG8VzwS4lck9QvHcMNlw8o7AKr/q0ZWCcslMFZq7E
+    fmv6lZLl2Jw0go6dsh2kCRRGjoG4CoQ5YelRYgjzmNPDp4cN8rwKy/Oy80OGjvXt
+    +AgZvpjuBYGEEvSIM3QttU+6OOuHKxseAY5sbWzuhru0xASq3P4e2pQk8EacnTJc
+    OrMMDXd39vTazhEb1INJzOeD0fiBNTscQD/vbO0vffrNQiTF6NaKZErRhadZWDCq
+    3w5SslAEuHMF3op8KhrCggWG3HlQiHyt0GTKagz8DAKum8/ZMyuoIwp1UIrgp/q7
+    fZeqdSDqS5UCAwEAAaNCMEAwDgYDVR0PAQH/BAQDAgGGMA8GA1UdEwEB/wQFMAMB
+    Af8wHQYDVR0OBBYEFEjYpg0hI2j/UC88pR/aG1oeY4VnMA0GCSqGSIb3DQEBCwUA
+    A4ICAQDNIXgdYnKyDjI95dYSiqsdc4Je7hdFA62/9HXYkjtlsycmm3GM33DcX94N
+    9siAtnir6Br3yzGKdwQ8ZB5iZw6aIZTfgwgcnJA/Zrhsx0nfIyIlgZQHOalHXvXt
+    keE2XoMzF8vzN3YsMpEHT7gRrRQ7Rvn+wufgql5oiO0iaf6XYLypoyXKrBsg+gLh
+    8Ek29TuWry9Ip04wtfNCff0+o/vrSpsDVIA34ayEpDqKQqjEgxA8EF3MfXaA3aYb
+    JWcz+BR2eX3xACkkjCNMuVJFPdsdJyDPmWe8hESpdDY0ATBgyOiZtlcpK+3Uo/WN
+    AZX856Axi4vJjkNe8ve8+B3oCCbBVZHaPjoi9jEWt/FmO1mtM1On2SWKgHGM4olz
+    9nQUL6G+4qypWOCzgu1xtCGIOP184oWR6TMplEHafBUWfamRmNsMxzzWCujGCtFh
+    O43WajhM2fo2T3egtpCX3orzuOVIisT2trP8pgClB5IKqvoCKc7cyKEb8Va1MVur
+    pqu+4wNmvZ+M7xRAJhd7FljkeOUTGb3ziuVd8YHsx/GTmJV9QXN1CZsVaRJCZdTt
+    DcHPaQDiwfSdr+p6ILpyGPH0l+2A+NXSjDI/tCK9CIzeleCPy4m1UhffSqKOaEKs
+    Gn1E5oROiqzjN5SWKHJRShbxKMq+v3VBN0OZJxQAMshK9aC+eg==
+    -----END CERTIFICATE-----