<p>Background: I have a springboot app that is containerized using docker and runs on a kubernetes cluster. It performs API calls, and relies on an SSLContext that requires loading a .jks truststore, like so:</p>

<pre class="lang-java prettyprint-override"><code>SSLContext sslcontext = SSLContexts.custom().loadTrustMaterial(ResourceUtils.getFile(keyStoreFilePath),
                        keyStorePassword.toCharArray(), new TrustSelfSignedStrategy()).build();
</code></pre>

<p>Note that the String keyStoreFilePath is currently injected as an environment/property variable at release time, and points to a location like /etc/ssl/keystore.jks on the host machine that runs a container. The disadvantage is that I have to resort to mounting this as a persistent volume in kubernetes for my containerized application to access it. </p>

<p>Instead, I decided to embed it into the application's classpath so that our operations team don't have to setting it up in all the host machines. But when I do, by specifying the keyStoreFilePath value like so: <code>classpath:security/keystore.jks</code>, it runs fine when I run the project in Eclipse/STS. But it fails with the error below inside the container:</p>

<p><code>class path resource [security/cacerts] cannot be resolved to absolute file path because it does not reside in the file system: jar:file:/app.jar!/BOOT-INF/classes!/security/cacerts","stackTrace":"org.springframework.util.ResourceUtils.getFile(ResourceUtils.java:217)
</code></p>

<p>Again, what is interesting is that the exact same thing runs just fine in Eclipse, but fails inside the container. Any pointers?</p>

<p><strong>Update:</strong> verified the keystore.jks file is &lt; 1 MB in size.</p>

code4kix
<p>The error message shows <code>file:/&lt;some-path-in-the-container&gt;/App.jar!/keystore.jks</code> - no "security" folder whereas the value passed in for <code>keyStoreFilePath</code> is <code>classpath:security/keystore.jks</code>?</p>

<p>It is unlikely that the JKS file is bigger than 1MB, which is the limit in Kubernetes for ConfigMap-s and Secrets, so an option is to create a <a href="https://kubernetes.io/docs/concepts/configuration/secret/" rel="nofollow noreferrer">Secret</a> with the JKS file and mount a volume from the Secret - no need to use a persistent volume or <a href="https://kubernetes.io/docs/concepts/storage/volumes/#hostpath" rel="nofollow noreferrer"><code>hostPath</code></a> volume.</p>

<p>HTH</p>
