Coder's OIDC init was crashlooping with "x509: certificate signed by
unknown authority" when fetching auth.renner.uno's OpenID discovery
document, because every ingress in this cluster uses the
letsencrypt-staging ClusterIssuer today.
Mount the staging roots (Pretend Pear X1 + Bogus Broccoli X2) via
coder.certs.secrets; the chart drops them at /etc/ssl/certs/ where
Go's crypto/x509 picks them up on Linux.
Remove once the cluster migrates to letsencrypt-prod.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
k.rennerandClaude Opus 4.7