docs: update GitLab links

.gitlab/merge_request_templates/new_feature.md

@@ -8,8 +8,8 @@ Closes #999
 ## Checklist
 
 * General:
-    * [ ] use [rules](https://docs.gitlab.com/ee/ci/yaml/#rules) instead of [only/except](https://docs.gitlab.com/ee/ci/yaml/#onlyexcept-advanced)
-    * [ ] optimized [cache](https://docs.gitlab.com/ee/ci/caching/) configuration (wherever applicable)
+    * [ ] use [rules](https://docs.gitlab.com/ci/yaml/#rules) instead of [only/except](https://docs.gitlab.com/ci/yaml/#onlyexcept-advanced)
+    * [ ] optimized [cache](https://docs.gitlab.com/ci/caching/) configuration (wherever applicable)
 * Publicly usable:
     * [ ] untagged runners
     * [ ] no proxy configuration but support `http_proxy`/`https_proxy`/`no_proxy`

CONTRIBUTING.md

@@ -61,7 +61,7 @@ To contribute:
 
 1. Create an issue describing the bug or enhancement you want to propose (select the right issue template).
 2. Make sure the issue has been reviewed and agreed.
-3. Create a Merge Request, from your **own** fork (see [forking workflow](https://docs.gitlab.com/ee/user/project/repository/forking_workflow.html) documentation).
+3. Create a Merge Request, from your **own** fork (see [forking workflow](https://docs.gitlab.com/user/project/repository/forking_workflow/) documentation).
    Don't hesitate to mark your MR as `Draft` as long as you think it's not ready to be reviewed.
 
 ### Git Commit Conventions

README.md

@@ -6,8 +6,8 @@ It supports [kaniko](https://github.com/GoogleContainerTools/kaniko), [Buildah](
 
 ## Usage
 
-This template can be used both as a [CI/CD component](https://docs.gitlab.com/ee/ci/components/#use-a-component)
-or using the legacy [`include:project`](https://docs.gitlab.com/ee/ci/yaml/index.html#includeproject) syntax.
+This template can be used both as a [CI/CD component](https://docs.gitlab.com/ci/components/#use-a-component)
+or using the legacy [`include:project`](https://docs.gitlab.com/ci/yaml/#includeproject) syntax.
 
 ### Use as a CI/CD component
 
@@ -49,10 +49,10 @@ The template supports following ways of building container images:
 3. Or using [buildah](https://buildah.io/), an open-source, daemonless tool backed by RedHat for building Docker
    images, and that solves Docker-in-Docker security issues (and also speeds-up build times), and can also be configured to run rootless.
 
-By default, the template uses the [kaniko](https://docs.gitlab.com/ee/ci/docker/using_kaniko.html) way, but you may
+By default, the template uses the [kaniko](https://docs.gitlab.com/ci/docker/using_kaniko.html) way, but you may
 select an alternate build tool by using the `DOCKER_BUILD_TOOL` variable (see below).
 
-:warning: If you choose to use 'Docker-in-Docker' option considering the associated security risks, make sure your runner has required privileges to run Docker-in-Docker ([see GitLab doc](https://docs.gitlab.com/ee/ci/docker/using_docker_build.html#use-docker-in-docker-workflow-with-docker-executor)).
+:warning: If you choose to use 'Docker-in-Docker' option considering the associated security risks, make sure your runner has required privileges to run Docker-in-Docker ([see GitLab doc](https://docs.gitlab.com/ci/docker/using_docker_build.html#use-docker-in-docker-workflow-with-docker-executor)).
 
 ### Global variables
 
@@ -160,7 +160,7 @@ There might be cases where you need to provide the complete [Docker configuratio
 If you are in one of those cases, you will need to use the `DOCKER_CONFIG_FILE` variable, expected to declare the path to your custom Docker configuration file (JSON). You may:
 
 - leave the default value (`.docker/config.json`) or override it to some alternate location in your project repository and create the file **without any secret in it** using our dynamic variables replacement (see below),
-- or override it as a GitLab project variable of type [File](https://docs.gitlab.com/ee/ci/variables/#cicd-variable-types), possibly inlining your secret credentials in it.
+- or override it as a GitLab project variable of type [File](https://docs.gitlab.com/ci/variables/#cicd-variable-types), possibly inlining your secret credentials in it.
 
 | Input / Variable                     | Description                                  | Default value         |
 | ------------------------------------ | -------------------------------------------- | --------------------- |
@@ -201,7 +201,7 @@ This file uses:
 - template-managed `${docker_snapshot_authent_token}`, `${docker_snapshot_registry_host}`, `${docker_release_authent_token}` and `${docker_release_registry_host}` variables,
 - the user-defined `${MY_OWN_REGISTRY_TOKEN}` (:information_source: an authentication token can be obtained with command `echo "user:password" | base64` and then be stored as a masked GitLab CI/CD project variable).
 
-Example 2: Docker configuration file declared as a GitLab project variable of type [File](https://docs.gitlab.com/ee/ci/variables/#cicd-variable-types) with **dynamic variables replacement**:
+Example 2: Docker configuration file declared as a GitLab project variable of type [File](https://docs.gitlab.com/ci/variables/#cicd-variable-types) with **dynamic variables replacement**:
 
 ```json
 {
@@ -221,14 +221,14 @@ Example 2: Docker configuration file declared as a GitLab project variable of ty
 
 This file uses:
 
-- template-managed `${docker_snapshot_authent_token}`, `${docker_snapshot_registry_host}`, `${docker_release_authent_token}` and `${docker_release_registry_host}` variables (:warning: mind the double `$$` to prevent GitLab from [trying to evaluate the variable](https://docs.gitlab.com/ee/ci/variables/index.html#use-the--character-in-variables)),
+- template-managed `${docker_snapshot_authent_token}`, `${docker_snapshot_registry_host}`, `${docker_release_authent_token}` and `${docker_release_registry_host}` variables (:warning: mind the double `$$` to prevent GitLab from [trying to evaluate the variable](https://docs.gitlab.com/ci/variables/#use-the--character-in-variables)),
 - the user-defined authentication may be inlined as a GitLab project variable is a place safe enough to store secrets.
 
 ## Multi Dockerfile support
 
 This template supports building multiple Docker images from a single Git repository.
 
-You can define the images to build using the [parallel matrix jobs](https://docs.gitlab.com/ee/ci/yaml/#parallel-matrix-jobs)
+You can define the images to build using the [parallel matrix jobs](https://docs.gitlab.com/ci/yaml/#parallel-matrix-jobs)
 pattern inside the `.docker-base` job (this is the top parent job of all Docker template jobs).
 
 Since each job in the template extends this base job, the pipeline will produce one job instance per image to build.
@@ -262,12 +262,12 @@ variables:
 
 Here are some advices about your **secrets** (variables marked with a :lock:):
 
-1. Manage them as [project or group CI/CD variables](https://docs.gitlab.com/ee/ci/variables/#for-a-project):
-   - [**masked**](https://docs.gitlab.com/ee/ci/variables/#mask-a-cicd-variable) to prevent them from being inadvertently
+1. Manage them as [project or group CI/CD variables](https://docs.gitlab.com/ci/variables/#for-a-project):
+   - [**masked**](https://docs.gitlab.com/ci/variables/#mask-a-cicd-variable) to prevent them from being inadvertently
      displayed in your job logs,
-   - [**protected**](https://docs.gitlab.com/ee/ci/variables/#protected-cicd-variables) if you want to secure some secrets
+   - [**protected**](https://docs.gitlab.com/ci/variables/#protected-cicd-variables) if you want to secure some secrets
      you don't want everyone in the project to have access to (for instance production secrets).
-2. In case a secret contains [characters that prevent it from being masked](https://docs.gitlab.com/ee/ci/variables/#mask-a-cicd-variable),
+2. In case a secret contains [characters that prevent it from being masked](https://docs.gitlab.com/ci/variables/#mask-a-cicd-variable),
    simply define its value as the [Base64](https://en.wikipedia.org/wiki/Base64) encoded value prefixed with `@b64@`:
    it will then be possible to mask it and the template will automatically decode it prior to using it.
 3. Don't forget to escape special characters (ex: `$` -> `$$`).
@@ -303,7 +303,7 @@ In addition to a textual report in the console, this job produces the following
 | Report                                       | Format                               | Usage                                                                                                                                                                          |
 | -------------------------------------------- | ------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
 | `reports/docker-hadolint-*.native.json`      | native hadolint test report (json)   | [DefectDojo integration](https://docs.defectdojo.com/en/connecting_your_tools/parsers/file/hadolint/)<br/>_This report is generated only if DefectDojo template is detected_ |
-| `reports/docker-hadolint-*.codeclimate.json` | hadolint (GitLab) codeclimate format | [GitLab integration](https://docs.gitlab.com/ee/ci/yaml/artifacts_reports.html#artifactsreportscodequality)                                                                    |
+| `reports/docker-hadolint-*.codeclimate.json` | hadolint (GitLab) codeclimate format | [GitLab integration](https://docs.gitlab.com/ci/yaml/artifacts_reports/#artifactsreportscodequality)                                                                    |
 
 ### `docker-*-build` jobs
 
@@ -323,7 +323,7 @@ It is bound to the `package-build` stage, and uses the following variables:
 | `build-cache-disabled` / `DOCKER_BUILD_CACHE_DISABLED`                  | Set to `true` to disable the build cache.<br/>Cache can typically be disabled when there is a network latency between the container registry and the runner.                                                                                                                      | _none_ (i.e cache enabled)     |
 | `push-args` / `DOCKER_PUSH_ARGS`                                        | Additional `push` arguments for [docker](https://docs.docker.com/reference/cli/docker/image/push/) or [buildah](https://github.com/containers/buildah/blob/main/docs/buildah-push.1.md) (executed right after `build`).<br>Ex: `--compression-format zstd --compression-level 20` | _(none)_                       |
 
-This job produces _output variables_ that are propagated to downstream jobs (using [dotenv artifacts](https://docs.gitlab.com/ee/ci/yaml/artifacts_reports.html#artifactsreportsdotenv)):
+This job produces _output variables_ that are propagated to downstream jobs (using [dotenv artifacts](https://docs.gitlab.com/ci/yaml/artifacts_reports/#artifactsreportsdotenv)):
 
 | Input / Variable      | Description                                            | Example                                                        |
 | --------------------- | ------------------------------------------------------ | -------------------------------------------------------------- |
@@ -354,7 +354,7 @@ LABEL name="my-project"                   \
       maintainer="my-project@acme.com"
 ```
 
-Default value for `DOCKER_METADATA` supports a subset of the [OCI Image Format Specification](https://github.com/opencontainers/image-spec/blob/master/annotations.md) for labels and use [GitLab CI pre-defined variables](https://docs.gitlab.com/ee/ci/variables/predefined_variables.html) to guess the value as follow :
+Default value for `DOCKER_METADATA` supports a subset of the [OCI Image Format Specification](https://github.com/opencontainers/image-spec/blob/master/annotations.md) for labels and use [GitLab CI pre-defined variables](https://docs.gitlab.com/ci/variables/predefined_variables/) to guess the value as follow :
 
 | Label                               | GitLab CI pre-defined variable |
 | ----------------------------------- | ------------------------------ |
@@ -392,7 +392,7 @@ If you have defined one of those labels in the Dockerfile, the final value will
 
 ### `docker-healthcheck` job
 
-:warning: this job requires that your runner has required privileges to run [Docker-in-Docker](https://docs.gitlab.com/ee/ci/docker/using_docker_build.html#use-docker-in-docker-workflow-with-docker-executor).
+:warning: this job requires that your runner has required privileges to run [Docker-in-Docker](https://docs.gitlab.com/ci/docker/using_docker_build.html#use-docker-in-docker-workflow-with-docker-executor).
 If it is not the case this job will not be run.
 
 This job performs a [Health Check](https://docs.docker.com/engine/reference/builder/#healthcheck) on your built image.
@@ -445,7 +445,7 @@ In addition to a textual report in the console, this job produces the following
 | Report                               | Format                                                                                                             | Usage                                                                                                                                                                       |
 | ------------------------------------ | ------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | `reports/docker-trivy-*.native.json` | native Trivy report format (json)                                                                                  | [DefectDojo integration](https://docs.defectdojo.com/en/connecting_your_tools/parsers/file/trivy/)<br/>_This report is generated only if DefectDojo template is detected_ |
-| `reports/docker-trivy-*.gitlab.json` | [Trivy report format for GitLab](https://aquasecurity.github.io/trivy/latest/tutorials/integrations/gitlab-ci/) format | [GitLab integration](https://docs.gitlab.com/ee/ci/yaml/artifacts_reports.html#artifactsreportscontainer_scanning)                                                          |
+| `reports/docker-trivy-*.gitlab.json` | [Trivy report format for GitLab](https://aquasecurity.github.io/trivy/latest/tutorials/integrations/gitlab-ci/) format | [GitLab integration](https://docs.gitlab.com/ci/yaml/artifacts_reports/#artifactsreportscontainer_scanning)                                                          |
 
 ### `docker-sbom` job
 
@@ -473,7 +473,7 @@ This job pushes (_promotes_) the built image as the _release_ image [skopeo](htt
 | `release-extra-tags` / `DOCKER_RELEASE_EXTRA_TAGS`                 | Defines extra tags to publish the _release_ image (supports capturing group references from `$DOCKER_RELEASE_EXTRA_TAGS_PATTERN` - [see below](#using-extra-tags)) | _(none)_                                                                                                                                                        |
 | `semrel-release-disabled` / `DOCKER_SEMREL_RELEASE_DISABLED`       | Set to `true` to disable [semantic-release integration](#semantic-release-integration)                                                                             | _none_ (enabled)                                                                                                                                                |
 
-This job produces _output variables_ that are propagated to downstream jobs (using [dotenv artifacts](https://docs.gitlab.com/ee/ci/yaml/artifacts_reports.html#artifactsreportsdotenv)):
+This job produces _output variables_ that are propagated to downstream jobs (using [dotenv artifacts](https://docs.gitlab.com/ci/yaml/artifacts_reports/#artifactsreportsdotenv)):
 
 | Input / Variable      | Description                                           | Example                                               |
 | --------------------- | ----------------------------------------------------- | ----------------------------------------------------- |
@@ -576,7 +576,7 @@ Depending on the Docker registry you're using, you may have to use a real passwo
 
 ### Building multiple Docker images
 
-Here is a `.gitlab-ci.yaml` that builds 2 Docker images from the same project (uses [parallel matrix jobs](https://docs.gitlab.com/ee/ci/yaml/#parallel-matrix-jobs)):
+Here is a `.gitlab-ci.yaml` that builds 2 Docker images from the same project (uses [parallel matrix jobs](https://docs.gitlab.com/ci/yaml/#parallel-matrix-jobs)):
 
 ```yaml
 include:
@@ -613,7 +613,7 @@ In order to be able to communicate with the Vault server, the variant requires t
 | :lock: `VAULT_ROLE_ID`              | The [AppRole](https://www.vaultproject.io/docs/auth/approle) RoleID                                                             | _none_                                                                     |
 | :lock: `VAULT_SECRET_ID`            | The [AppRole](https://www.vaultproject.io/docs/auth/approle) SecretID                                                           | _none_                                                                     |
 
-By default, the variant will authentifacte using a [JWT ID token](https://docs.gitlab.com/ee/ci/secrets/id_token_authentication.html). To use [AppRole](https://www.vaultproject.io/docs/auth/approle) instead the `VAULT_ROLE_ID` and `VAULT_SECRET_ID` should be defined as secret project variables.
+By default, the variant will authentifacte using a [JWT ID token](https://docs.gitlab.com/ci/secrets/id_token_authentication/). To use [AppRole](https://www.vaultproject.io/docs/auth/approle) instead the `VAULT_ROLE_ID` and `VAULT_SECRET_ID` should be defined as secret project variables.
 
 #### Usage
 
@@ -669,7 +669,7 @@ List of requirements before using this variant for publishing your container ima
 | ----------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------- |
 | `TBC_GCP_PROVIDER_IMAGE`                                    | The [GCP Auth Provider](https://gitlab.com/to-be-continuous/tools/gcp-auth-provider) image to use (can be overridden)                                       | `registry.gitlab.com/to-be-continuous/tools/gcp-auth-provider:latest` |
 | `gcp-oidc-aud` / `GCP_OIDC_AUD`                             | The `aud` claim for the JWT token                                                                                                                           | `$CI_SERVER_URL`                                                      |
-| `gcp-oidc-provider` / `GCP_OIDC_PROVIDER`                   | Default Workload Identity Provider associated with GitLab to [authenticate with OpenID Connect](https://docs.gitlab.com/ee/ci/cloud_services/google_cloud/) | _none_                                                                |
+| `gcp-oidc-provider` / `GCP_OIDC_PROVIDER`                   | Default Workload Identity Provider associated with GitLab to [authenticate with OpenID Connect](https://docs.gitlab.com/ci/cloud_services/google_cloud/) | _none_                                                                |
 | `gcp-oidc-account` / `GCP_OIDC_ACCOUNT`                     | Default Service Account to which impersonate with OpenID Connect authentication                                                                             | _none_                                                                |
 | `gcp-snapshot-oidc-provider` / `GCP_SNAPSHOT_OIDC_PROVIDER` | Workload Identity Provider to push the snapshot image _(only define to override default)_                                                                   | _none_                                                                |
 | `gcp-snapshot-oidc-account` / `GCP_SNAPSHOT_OIDC_ACCOUNT`   | Service Account to use to push the snapshot image _(only define to override default)_                                                                       | _none_                                                                |
@@ -712,7 +712,7 @@ that will be used as a temporary credential to login to the ECR registry.
 
 In order to use the AWS APIs, the variant supports two authentication methods:
 
-1. [federated authentication using OpenID Connect](https://docs.gitlab.com/ee/ci/cloud_services/aws/) (**recommended method**),
+1. [federated authentication using OpenID Connect](https://docs.gitlab.com/ci/cloud_services/aws/) (**recommended method**),
 2. or basic authentication with AWS access key ID & secret access key.
 
 :warning: when using this variant, you must have created the ECR repositories to push the snapshot and/or the release images.
@@ -731,7 +731,7 @@ to use the snapshot image repository (will host your snapshot image as well as c
 
 ##### OIDC authentication config
 
-This is the recommended authentication method. In order to use it, first carefuly follow [GitLab's documentation](https://docs.gitlab.com/ee/ci/cloud_services/aws/),
+This is the recommended authentication method. In order to use it, first carefuly follow [GitLab's documentation](https://docs.gitlab.com/ci/cloud_services/aws/),
 then set the required configuration.
 
 | Input / Variable                                            | Description                                                                                    | Default value    |

kicker.json

@@ -269,7 +269,7 @@
         },
         {
           "name": "GCP_OIDC_AUD",
-          "description": "The `aud` claim for the JWT token _(only required for [OIDC authentication](https://docs.gitlab.com/ee/ci/cloud_services/aws/))_",
+          "description": "The `aud` claim for the JWT token _(only required for [OIDC authentication](https://docs.gitlab.com/ci/cloud_services/aws/))_",
           "default": "$CI_SERVER_URL",
           "advanced": true
         },
@@ -279,7 +279,7 @@
         },
         {
           "name": "GCP_OIDC_PROVIDER",
-          "description": "Default Workload Identity Provider associated with GitLab to [authenticate with OpenID Connect](https://docs.gitlab.com/ee/ci/cloud_services/google_cloud/)"
+          "description": "Default Workload Identity Provider associated with GitLab to [authenticate with OpenID Connect](https://docs.gitlab.com/ci/cloud_services/google_cloud/)"
         },
         {
           "name": "GCP_SNAPSHOT_OIDC_ACCOUNT",
@@ -331,22 +331,22 @@
         },
         {
           "name": "AWS_OIDC_AUD",
-          "description": "The `aud` claim for the JWT token _(only required for [OIDC authentication](https://docs.gitlab.com/ee/ci/cloud_services/aws/))_",
+          "description": "The `aud` claim for the JWT token _(only required for [OIDC authentication](https://docs.gitlab.com/ci/cloud_services/aws/))_",
           "default": "$CI_SERVER_URL",
           "advanced": true
         },
         {
           "name": "AWS_OIDC_ROLE_ARN",
-          "description": "Default IAM Role ARN associated with GitLab _(only required for [OIDC authentication](https://docs.gitlab.com/ee/ci/cloud_services/aws/))_"
+          "description": "Default IAM Role ARN associated with GitLab _(only required for [OIDC authentication](https://docs.gitlab.com/ci/cloud_services/aws/))_"
         },
         {
           "name": "AWS_SNAPSHOT_OIDC_ROLE_ARN",
-          "description": "IAM Role ARN associated with GitLab for the snapshot image _(only required for [OIDC authentication](https://docs.gitlab.com/ee/ci/cloud_services/aws/) and if different from default)_",
+          "description": "IAM Role ARN associated with GitLab for the snapshot image _(only required for [OIDC authentication](https://docs.gitlab.com/ci/cloud_services/aws/) and if different from default)_",
           "advanced": true
         },
         {
           "name": "AWS_RELEASE_OIDC_ROLE_ARN",
-          "description": "IAM Role ARN associated with GitLab for the release image _(only required for [OIDC authentication](https://docs.gitlab.com/ee/ci/cloud_services/aws/) and if different from default)_",
+          "description": "IAM Role ARN associated with GitLab for the release image _(only required for [OIDC authentication](https://docs.gitlab.com/ci/cloud_services/aws/) and if different from default)_",
           "advanced": true
         },
         {

templates/gitlab-ci-docker-ecr.yml

@@ -15,20 +15,20 @@ spec:
         different from default)_
       default: ''
     aws-oidc-aud:
-      description: The `aud` claim for the JWT token _(only required for [OIDC authentication](https://docs.gitlab.com/ee/ci/cloud_services/aws/))_
+      description: The `aud` claim for the JWT token _(only required for [OIDC authentication](https://docs.gitlab.com/ci/cloud_services/aws/))_
       default: $CI_SERVER_URL
     aws-oidc-role-arn:
       description: Default IAM Role ARN associated with GitLab _(only required for [OIDC
-        authentication](https://docs.gitlab.com/ee/ci/cloud_services/aws/))_
+        authentication](https://docs.gitlab.com/ci/cloud_services/aws/))_
       default: ''
     aws-snapshot-oidc-role-arn:
       description: IAM Role ARN associated with GitLab for the snapshot image _(only
-        required for [OIDC authentication](https://docs.gitlab.com/ee/ci/cloud_services/aws/)
+        required for [OIDC authentication](https://docs.gitlab.com/ci/cloud_services/aws/)
         and if different from default)_
       default: ''
     aws-release-oidc-role-arn:
       description: IAM Role ARN associated with GitLab for the release image _(only
-        required for [OIDC authentication](https://docs.gitlab.com/ee/ci/cloud_services/aws/)
+        required for [OIDC authentication](https://docs.gitlab.com/ci/cloud_services/aws/)
         and if different from default)_
       default: ''
 ---

templates/gitlab-ci-docker-gcp.yml

@@ -4,7 +4,7 @@
 spec:
   inputs:
     gcp-oidc-aud:
-      description: The `aud` claim for the JWT token _(only required for [OIDC authentication](https://docs.gitlab.com/ee/ci/cloud_services/aws/))_
+      description: The `aud` claim for the JWT token _(only required for [OIDC authentication](https://docs.gitlab.com/ci/cloud_services/aws/))_
       default: $CI_SERVER_URL
     gcp-oidc-account:
       description: Default Service Account to which impersonate with OpenID Connect
@@ -12,7 +12,7 @@ spec:
       default: ''
     gcp-oidc-provider:
       description: Default Workload Identity Provider associated with GitLab to [authenticate
-        with OpenID Connect](https://docs.gitlab.com/ee/ci/cloud_services/google_cloud/)
+        with OpenID Connect](https://docs.gitlab.com/ci/cloud_services/google_cloud/)
       default: ''
     gcp-snapshot-oidc-account:
       description: Service Account to use to push the snapshot image _(only define if

templates/gitlab-ci-docker.yml

@@ -786,7 +786,7 @@ stages:
   extends: .docker-base
   image: $DOCKER_IMAGE
   variables:
-    # disable TLS between Docker client and Docker daemon : https://docs.gitlab.com/ee/ci/docker/using_docker_build.html#tls-disabled
+    # disable TLS between Docker client and Docker daemon : https://docs.gitlab.com/ci/docker/using_docker_build.html#tls-disabled
     DOCKER_HOST: tcp://docker:2375
     DOCKER_TLS_CERTDIR: ""
     # make visible DEFAULT_CA_CERTS and CUSTOM_CA_CERTS variables to the service (we MUST use different variable names)