AI Center and Document Understanding pods fail to start with TLS certificate verification enabled

Solutions for AI Center and Document Understanding pods failing with TLS certificate verification enabled in Automation Suite on OpenShift.

Description

When database TLS certificate verification is enabled (trustservercertificate=false in the SQL connection string), some AI Center and Document Understanding pods may get stuck in Init:CrashLoopBackOff. The await-migration-completion init container fails to connect to the database, with TLS/SSL handshake errors in the logs.

Solution

To address the issue, take the following steps:

1. Disable Auto-Sync for AI Center and Document Understanding in ArgoCD.

2. Manually add the following volume mounts to the await-migration-completion init container in each affected deployment.

   For aistorage and aistorage-cleanup:

   - mountPath: /etc/pki/ca-trust/extracted/java/
     name: java
   - mountPath: /etc/pki/ca-trust/extracted/edk2/
     name: edk2
   - mountPath: /etc/pki/ca-trust/extracted/pem/
     name: pem
   - mountPath: /etc/pki/ca-trust/extracted/openssl/
     name: openssl
   - mountPath: /etc/pki/ca-trust/source/anchors/
     name: cert-location
   

   For du-digitizer and du-digitizer-cleanup:

   - mountPath: /etc/ssl/certs
     name: cert-trust-store
   - mountPath: /usr/local/share/ca-certificates
     name: cert-location
   

   Note:

   These volumes are already defined at the pod level and only need to be mounted into the init container.

3. Enable Auto-Sync again.