2025.1.0 AM fails: Can't open boot keystore

[mayur-dorlikar]

Summary:
AM pod restarts in loop due to boot keystore error (ForgeOps 25.1.0 on OpenShift 4.13)

Description:
I have deployed ForgeOps version 25.1.0 on an OpenShift 4.13 cluster (Kubernetes-based deployment).

Every alternate day, the AM pod restarts continuously in a loop with the following error:

Can't open boot keystore
AM startup fails with the following error:
java.security.KeyStoreException: Incorrect password used to retrieve secret key with alias configStorePwd
at org.forgerock.openam.utils.AMKeyProvider.getSecret

Impact:
Due to this issue, AM is unavailable whenever this happens, which affects authentication services for our applications.

[lee-baines]

Hi,
This is because the init-container provides the default system boot.json for startup before the main container updates the used the new provide boot.json. But when a failure causes the main container to restart, the wrong boot.json is used.

This issue is fixed in our dev branch and will be available in our next release next month 2025.2.0.
In the meantime, you can add the workaround to your branch. See the lines from our dev branch below:
(Helm)

• https://github.com/ForgeRock/forgeops/blob/dev/charts/identity-platform/files/am/entrypoint-scripts/entrypoint.sh#L13
• https://github.com/ForgeRock/forgeops/blob/dev/charts/identity-platform/templates/am-deployment.yaml#L116

(Kustomize)

• https://github.com/ForgeRock/forgeops/blame/dev/kustomize/base/am/resources.yaml#L28
• https://github.com/ForgeRock/forgeops/blame/dev/kustomize/base/am/resources.yaml#L230