# Distribute the private CA bundle across the cluster with trust-manager.
# Avoid hard-coding trust anchors into application images.
apiVersion: trust.cert-manager.io/v1alpha1
kind: Bundle
metadata:
  name: internal-trust-bundle
spec:
  sources:
    - secret:
        name: internal-root-ca
        key: tls.crt
  target:
    configMap:
      key: ca-bundle.pem
    namespaceSelector:
      matchLabels:
        trust-bundle: enabled
