Support running update-ca-trust at runtime

Required to add the kubernetes self-signed ca at runtime so we can
connect to the ceph s3 service.