AI Center and Document Understanding pods fail to start with TLS certificate verification enabled

Solutions for pod startup failures with TLS verification in Automation Suite on EKS/AKS, including volume mount configuration.

Description

When database TLS certificate verification is enabled (trustservercertificate=false in the SQL connection string), some AI Center and Document Understanding pods may get stuck in Init:CrashLoopBackOff. The await-migration-completion init container fails to connect to the database, with TLS/SSL handshake errors in the logs.

Solution

To address the issue, take the following steps:

1. Disable Auto-Sync for AI Center and Document Understanding in ArgoCD.

2. Manually add the following volume mounts to the await-migration-completion init container in each affected deployment.

   For aistorage and aistorage-cleanup:

   - mountPath: /etc/pki/ca-trust/extracted/java/
     name: java
   - mountPath: /etc/pki/ca-trust/extracted/edk2/
     name: edk2
   - mountPath: /etc/pki/ca-trust/extracted/pem/
     name: pem
   - mountPath: /etc/pki/ca-trust/extracted/openssl/
     name: openssl
   - mountPath: /etc/pki/ca-trust/source/anchors/
     name: cert-location
   

   For du-digitizer and du-digitizer-cleanup:

   - mountPath: /etc/ssl/certs
     name: cert-trust-store
   - mountPath: /usr/local/share/ca-certificates
     name: cert-location
   

   Note:

   These volumes are already defined at the pod level and only need to be mounted into the init container.

3. Enable Auto-Sync again.