KB data source configuration fails during SSL validation when connecting to an S3-compatible NAS endpoint

Products

• VCF Private AI Services

Issue/Introduction

1.The configuration UI returns a credential validation error specifically citing a self-signed certificate in the chain:

"
The credentials weren't successfully validated. SSL validation failed for https://<S3 endpoint URL> [SSL:CERTIFICATE_VERIFY_FAILED] certificate verify failed:self-signed certificate in certificate chain (_ssl.c:1016)
"

2.The peer certificate consists of two parts: the NAS's own certificate and the root certificate signed by the CA. Both certificates have been imported into PAIF, and the corresponding configmap has been generated already

Environment

VMware Private AI Service 2.1

Cause

PAIS pods fail to hot-reload CA trust bundles added after initial pod startup, a known limitation fixed in PAIS 3.0.

Resolution

1. Execute a rollout restart of all PAIS-managed deployments to force a reload of the CA trust bundle.

kubectl rollout restart deployment -l pais.vmware.com/owner.uid=$(kubectl get paisconfiguration default --template='{{.metadata.uid}}')

2. Verify all pods reach a 'Running' state before re-attempting the KB data source configuration.

kubectl rollout status deployment -l pais.vmware.com/owner.uid=$(kubectl get paisconfiguration default --template='{{.metadata.uid}}')

3. Complete the KB data source configuration in the UI.