document how to mount a custom CA bundle

[ktdreyer]

Summary

• Adds docs/src/content/docs/guides/custom-ca-bundle.md
• Explains the OpenShift CA injection approach: annotate a trusted-ca-bundle ConfigMap and mount it over /etc/pki/tls/certs/ca-bundle.crt in the backend pod
• Covers the manual ConfigMap option for non-OpenShift Kubernetes
• Includes a support status table noting that runner pod support is pending mount trusted CA bundle in runner pods for custom TLS #1247 and Support custom SSL root CAs for internal GitLab instances #1038

Test plan

• Verify the doc renders correctly in the Astro docs site
• Confirm all links to mount trusted CA bundle in runner pods for custom TLS #1247 and Support custom SSL root CAs for internal GitLab instances #1038 resolve

Closes #1248

Summary by CodeRabbit

• Documentation
  • Added "Mounting a Custom CA Bundle" guide explaining how Ambient containers can trust private/corporate certificate authorities. Includes step-by-step workflows for OpenShift and generic Kubernetes deployments, a verification command, and a support status table noting backend-api as supported and runner pods as pending.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: b07f5c41-732c-4749-a3d3-b12206810fa5

📥 Commits

Reviewing files that changed from the base of the PR and between 98314cb and cc650d3.

📒 Files selected for processing (1)

• docs/src/content/docs/guides/custom-ca-bundle.md

✅ Files skipped from review due to trivial changes (1)

• docs/src/content/docs/guides/custom-ca-bundle.md

---

📝 Walkthrough

Walkthrough

Added a new guide documenting how to configure Ambient to trust private/corporate CAs by updating the system CA bundle at /etc/pki/tls/certs/ca-bundle.crt. Describes OpenShift automatic injection via config.openshift.io/inject-trusted-cabundle and manual ConfigMap mounting for non-OpenShift clusters; notes runner pod support is pending.

Changes

Cohort / File(s)	Summary
Custom CA Bundle Documentation docs/src/content/docs/guides/custom-ca-bundle.md	New guide "Mounting a Custom CA Bundle" explaining how Ambient reads /etc/pki/tls/certs/ca-bundle.crt, OpenShift trusted-ca-bundle injection workflow (use config.openshift.io/inject-trusted-cabundle: "true"), manual trusted-ca-bundle ConfigMap creation/mount for non-OpenShift, verification kubectl exec ... curl, and support status (backend-api supported; runner pods pending).

🚥 Pre-merge checks | ✅ 7 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Title check	⚠️ Warning	Title lacks Conventional Commits format (missing type prefix like 'docs'). Should be 'docs: document how to mount a custom CA bundle'.	Reformat title to follow Conventional Commits: 'docs: document how to mount a custom CA bundle'.

✅ Passed checks (7 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Linked Issues check	✅ Passed	PR comprehensively addresses all objectives from #1248: explains CA usage, provides OpenShift and non-OpenShift workflows, specifies namespace deployment, includes verification steps, and notes pending runner pod support (#1247, #1038).
Out of Scope Changes check	✅ Passed	Changes are entirely in-scope: single documentation file directly addressing #1248 requirements with no extraneous alterations.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Performance And Algorithmic Complexity	✅ Passed	Documentation-only change adding markdown guide; performance and algorithmic complexity checks are inapplicable to documentation files.
Security And Secret Handling	✅ Passed	Documentation correctly uses ConfigMaps for CA certificates (public data), leverages OpenShift CA injection, and contains no hardcoded secrets, plaintext credentials, or injection vulnerabilities.
Kubernetes Resource Safety	✅ Passed	Kubernetes manifests are safe: ConfigMaps properly namespace-scoped, volumes mounted read-only, no unsafe child resources or RBAC issues present.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch kdreyer/docs-custom-ca-bundle

✨ Simplify code

• Create PR with simplified code
• Commit simplified code in branch kdreyer/docs-custom-ca-bundle

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[ktdreyer]

We should also remove the docs about Self-Signed SSL Certificates from docs/internal/integrations/gitlab-self-hosted.md