Have you looked at

datastoreTLSSecretName

? If you point that to a secret with tls config for the crdb cluster it should mount to both pods and you shouldn’t need patches. When I’m back at a computer I can find the docs for you, it mounts them at a specific location you can reference in your connection string.