Document existingCACertificate footgun (#63516)

docs/pages/includes/helm-reference/zz_generated.teleport-kube-agent.mdx

@@ -704,6 +704,12 @@ You must create a secret containing the CA certs in the same namespace as Telepo
 ```code
 $ kubectl create secret generic my-root-ca --from-file=ca.pem=/path/to/root-ca.pem
 ```
+<Admonition type="danger">
+The Teleport distroless container trusts by default CAs from the `ca-certificates` package (Mozilla PKI).
+When `existingCASecretName` is set, Teleport only trusts the CA bundle from the secret.
+If you need Teleport to interact with other systems (e.g. AWS, GitHub, ...), the secret must contain their CA.
+Else, Teleport will fail to establish TLS connections with external services.
+</Admonition>
 
 ### `tls.existingCASecretKeyName`
 

docs/pages/includes/helm-reference/zz_generated.teleport-operator.mdx

@@ -343,6 +343,12 @@ command such as:
 ```code
 $ kubectl create secret generic my-root-ca --from-file=ca.pem=/path/to/root-ca.pem
 ```
+<Admonition type="danger">
+The Teleport operator container trusts by default CAs from the `ca-certificates` package (Mozilla PKI).
+When `existingCASecretName` is set, Teleport only trusts the CA bundle from the secret.
+If you need the operator to interact with other systems (e.g. AWS joining), the secret must contain their CA.
+Else, Teleport will fail to establish TLS connections with external services.
+</Admonition>
 
 ### `tls.existingCASecretKeyName`
 

docs/pages/reference/helm-reference/teleport-cluster.mdx

@@ -1550,6 +1550,12 @@ You should create the secret in the same namespace as Teleport using a command l
 ```code
 $ kubectl create secret generic my-root-ca --from-file=ca.pem=/path/to/root-ca.pem
 ```
+<Admonition type="danger">
+The Teleport distroless container trusts by default CAs from the `ca-certificates` package (Mozilla PKI).
+When `existingCASecretName` is set, Teleport only trusts the CA bundle from the secret.
+If you need Teleport to interact with other systems (e.g. AWS, GitHub, ...), the secret must contain their CA.
+Else, Teleport will fail to establish TLS connections with external services.
+</Admonition>
 
 `values.yaml` example:
 

examples/chart/teleport-cluster/charts/teleport-operator/values.yaml

@@ -198,6 +198,12 @@ tls:
   # ```code
   # $ kubectl create secret generic my-root-ca --from-file=ca.pem=/path/to/root-ca.pem
   # ```
+  # <Admonition type="danger">
+  # The Teleport operator container trusts by default CAs from the `ca-certificates` package (Mozilla PKI).
+  # When `existingCASecretName` is set, Teleport only trusts the CA bundle from the secret.
+  # If you need the operator to interact with other systems (e.g. AWS joining), the secret must contain their CA.
+  # Else, Teleport will fail to establish TLS connections with external services.
+  # </Admonition>
   existingCASecretName: ""
   # tls.existingCASecretKeyName(string) -- determines which key in the CA secret
   # will be used as a trusted CA bundle file.

examples/chart/teleport-cluster/values.yaml

@@ -585,6 +585,11 @@ tls:
   # Useful for building trust when using intermediate certificate authorities.
   # This will automatically set the SSL_CERT_FILE environment variable to trust the CA.
   # Create the secret with `kubectl create secret generic --from-file=ca.pem=/path/to/root-ca.pem
+  #
+  # DANGER: The Teleport distroless container trusts by default CAs from the `ca-certificates` package (Mozilla PKI).
+  # When `existingCASecretName` is set, Teleport only trusts the CA bundle from the secret.
+  # If you need Teleport to interact with other systems (e.g. AWS, GitHub, ...), the secret must contain their CA.
+  # Else, Teleport will fail to establish TLS connections with external services.
   existingCASecretName: ""
   # (optional) Name of an existing key in the CA secret which will be used as a trusted CA bundle file.
   existingCASecretKeyName: "ca.pem"

examples/chart/teleport-kube-agent/values.yaml

@@ -588,6 +588,12 @@ tls:
   # ```code
   # $ kubectl create secret generic my-root-ca --from-file=ca.pem=/path/to/root-ca.pem
   # ```
+  # <Admonition type="danger">
+  # The Teleport distroless container trusts by default CAs from the `ca-certificates` package (Mozilla PKI).
+  # When `existingCASecretName` is set, Teleport only trusts the CA bundle from the secret.
+  # If you need Teleport to interact with other systems (e.g. AWS, GitHub, ...), the secret must contain their CA.
+  # Else, Teleport will fail to establish TLS connections with external services.
+  # </Admonition>
   existingCASecretName: ""
   # tls.existingCASecretKeyName(string) -- determines which key in the CA secret
   # will be used as a trusted CA bundle file.