[isometry]

Summary

• Add manager.extraVolumes and manager.extraVolumeMounts to the Helm chart (default [], so rendered output is unchanged by default).
• Document how to trust additional CAs behind a TLS-inspecting firewall: mount a ConfigMap of PEM CAs (optional: true, so a missing ConfigMap leaves only the system CAs) and extend SSL_CERT_DIR, listing Go's default CA directories explicitly so system trust stays intact.
• Bump chart version to 0.5.0.

manager:
  env:
    - name: SSL_CERT_DIR
      value: /etc/ssl/certs:/etc/pki/tls/certs:/etc/ssl/extra-ca
  extraVolumes:
    - name: extra-ca
      configMap:
        name: corp-ca
        optional: true
  extraVolumeMounts:
    - name: extra-ca
      mountPath: /etc/ssl/extra-ca
      readOnly: true

Test plan

• helm lint deploy/charts/github-token-manager
• helm template with the example values renders the env var, volume and mount
• helm template with default values renders no extra volumes
• End-to-end against a real TLS-inspecting proxy (e.g. mitmproxy in Kind) — not done

🤖 Generated with Claude Code