feat(ec): new PrivateCACert template function behavior (#3278)

* feat(ec): new PrivateCACert template function behavior

* Explain how we find the ca trust store on the host

* docs edits

* Update template-functions-static-context.md

---------

Co-authored-by: Paige Calvert <paige@replicated.com>

Author: emosbaugh

docs/reference/template-functions-static-context.md

@@ -16,12 +16,12 @@ This topic provides a list of the KOTS template functions in the Static context.
 func PrivateCACert() string
 ```
 
-PrivateCACert returns the name of a ConfigMap that contains private CA certificates provided by the end user. For Embedded Cluster installations, these certificates are provided with the `--private-ca` flag for the `install` command. For KOTS installations, the user provides the ConfigMap using the `--private-ca-configmap` flag for the `install` command.
+For KOTS installations, PrivateCACert returns the name of a ConfigMap that contains CA certificates provided by the end user with the `--private-ca-configmap` flag for the install command. For Embedded Cluster installations, the ConfigMap returned by PrivateCACert contains the CA trust store from the host. Embedded Cluster determines the CA trust store by first checking for the SSL_CERT_FILE environment variable. If SSL_CERT_FILE is not set, Embedded Cluster then searches common certificate paths and uses the first valid certificate file found.
 
 You can use this template function to mount the specified ConfigMap so your containers can access the internet through enterprise proxies that issue their own TLS certificates in order to inspect traffic.
 
 :::note
-This function will return the name of the ConfigMap even if the ConfigMap has no entries. If no ConfigMap exists, this function returns the empty string.
+This function returns the name of the ConfigMap even if the ConfigMap has no entries. If no ConfigMap exists, this function returns the empty string.
 :::
 
 ## Cluster Information Functions
@@ -630,4 +630,4 @@ This can be useful when dealing with user-uploaded files that may include null b
 
 ```yaml
 repl{{ ConfigOptionData "my_file_upload" | YamlEscape }}
-```
+```