[bitnami/odoo] odoo.sql_db: Connection to the database failed

[hongbo-miao]

Name and Version

bitnami/odoo 28.1.3

What architecture are you using?

amd64

What steps will reproduce the bug?

I have a Postgres 17.4 using AWS RDS.

Here is my deployment code:

---
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: production-hm-odoo
  namespace: production-hm-argo-cd
  labels:
    app.kubernetes.io/name: hm-odoo
spec:
  project: production-hm
  sources:
    - repoURL: registry-1.docker.io/bitnamicharts
      # https://artifacthub.io/packages/helm/bitnami/odoo
      targetRevision: 28.1.3
      chart: odoo
      helm:
        releaseName: hm-odoo
        values: |
          # https://github.com/bitnami/charts/blob/main/bitnami/odoo/values.yaml
          ---
          image:
            debug: true
          global:
            imageRegistry: harbor.hongbomiao.com/docker-hub-proxy-cache
            security:
              allowInsecureImages: true
          odooEmail: [email protected]
          existingSecret: hm-odoo-secret
          service:
            type: ClusterIP
          postgresql:
            enabled: false
          externalDatabase:
            create: true
            host: production-hm-odoo-postgres.xxxxxxxxxxxx.us-west-2.rds.amazonaws.com
            port: 5432
            database: odoo_db
            user: odoo_user
            postgresqlPostgresUser: postgres
            existingSecret: hm-odoo-secret
            existingSecretPasswordKey: POSTGRES_USER_PASSWORD
            existingSecretPostgresPasswordKey: POSTGRES_ADMIN_PASSWORD
          persistence:
            enabled: true
            resourcePolicy: keep
            storageClass: production-hm-odoo-storage-class
            accessModes: ["ReadWriteOnce"]
            size: 100Gi
    - repoURL: [email protected]:hongbo-miao/hongbomiao.com.git
      targetRevision: main
      path: kubernetes/argo-cd/applications/production-hm/odoo/kubernetes-manifests
  destination:
    namespace: production-hm-odoo
    server: https://kubernetes.default.svc
  syncPolicy:
    syncOptions:
      - ServerSideApply=true
    automated:
      prune: true

---
apiVersion: bitnami.com/v1alpha1
kind: SealedSecret
metadata:
  name: hm-odoo-secret
  namespace: production-hm-odoo
  annotations:
    # https://argo-cd.readthedocs.io/en/stable/user-guide/resource_hooks
    argocd.argoproj.io/hook: PreSync
  labels:
    app.kubernetes.io/name: hm-odoo-secret
    app.kubernetes.io/part-of: production-hm-odoo
spec:
  encryptedData:
    odoo-password: xxx
    POSTGRES_ADMIN_PASSWORD: xxx
    POSTGRES_USER_PASSWORD: xxx
  template:
    metadata:
      name: hm-odoo-secret
      namespace: production-hm-odoo
      annotations:
        # https://argo-cd.readthedocs.io/en/stable/user-guide/resource_hooks
        argocd.argoproj.io/hook: PreSync
      labels:
        app.kubernetes.io/name: hm-odoo-secret
        app.kubernetes.io/part-of: production-hm-odoo

I can see it succeed creating the database and user

Also, PVC succeed bounding.

Are you using any custom parameters or values?

No response

What is the expected behavior?

I expect the Odoo pod succeed.

What do you see instead?

However, it keeps restarting with log:

odoo 08:14:54.09 INFO  ==>
odoo 08:14:54.09 INFO  ==> Welcome to the Bitnami odoo container
odoo 08:14:54.09 INFO  ==> Subscribe to project updates by watching https://github.com/bitnami/containers
odoo 08:14:54.09 INFO  ==> Did you know there are enterprise versions of the Bitnami catalog? For enhanced secure software supply chain features, unlimited pulls from Docker, LTS support, or application customization, see Bitnami Premium or Tanzu Application Catalog. See https://www.arrow.com/globalecs/na/vendors/bitnami/ for more information.
odoo 08:14:54.09 INFO  ==>
odoo 08:14:54.10 INFO  ==> Validating settings in POSTGRESQL_CLIENT_* env vars
odoo 08:14:54.10 INFO  ==> Trying to connect to the database server
odoo 08:14:54.13 INFO  ==> Creating database user odoo_user
odoo 08:14:54.15 INFO  ==> Creating database odoo_db
odoo 08:14:54.22 INFO  ==> Ensuring Odoo directories exist
odoo 08:14:54.23 INFO  ==> Trying to connect to the database server
odoo 08:14:54.25 INFO  ==> Validating database owner
odoo 08:14:54.27 INFO  ==> Generating configuration file
odoo 08:14:54.28 INFO  ==> Installing modules
/opt/bitnami/odoo/bin/odoo:4: DeprecationWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html
  __import__('pkg_resources').run_script('odoo==18.0.post20250205', 'odoo')
2025-03-04 09:02:07,899 85 INFO ? odoo: Odoo version 18.0-20250205
2025-03-04 09:02:07,900 85 INFO ? odoo: Using configuration file at /opt/bitnami/odoo/conf/odoo.conf
2025-03-04 09:02:07,900 85 INFO ? odoo: addons paths: ['/opt/bitnami/odoo/lib/odoo-18.0.post20250205-py3.12.egg/odoo/addons', '/opt/bitnami/odoo/data/addons/18.0', '/opt/bitnami/odoo/addons']
2025-03-04 09:02:07,900 85 INFO ? odoo: database: odoo_user@production-hm-odoo-postgres.xxxxxxxxxxxx.us-west-2.rds.amazonaws.com:5432
2025-03-04 09:02:07,906 85 INFO ? odoo.sql_db: Connection to the database failed
Traceback (most recent call last):
  File "/opt/bitnami/odoo/bin/odoo", line 4, in <module>
    __import__('pkg_resources').run_script('odoo==18.0.post20250205', 'odoo')
  File "/opt/bitnami/odoo/venv/lib/python3.12/site-packages/pkg_resources/__init__.py", line 747, in run_script
    self.require(requires)[0].run_script(script_name, ns)
  File "/opt/bitnami/odoo/venv/lib/python3.12/site-packages/pkg_resources/__init__.py", line 1734, in run_script
    exec(code, namespace, namespace)
  File "/opt/bitnami/odoo/lib/odoo-18.0.post20250205-py3.12.egg/EGG-INFO/scripts/odoo", line 8, in <module>
    odoo.cli.main()
  File "/opt/bitnami/odoo/lib/odoo-18.0.post20250205-py3.12.egg/odoo/cli/command.py", line 66, in main
    o.run(args)
  File "/opt/bitnami/odoo/lib/odoo-18.0.post20250205-py3.12.egg/odoo/cli/server.py", line 180, in run
    main(args)
  File "/opt/bitnami/odoo/lib/odoo-18.0.post20250205-py3.12.egg/odoo/cli/server.py", line 151, in main
    odoo.service.db._create_empty_database(db_name)
  File "/opt/bitnami/odoo/lib/odoo-18.0.post20250205-py3.12.egg/odoo/service/db.py", line 107, in _create_empty_database
    with closing(db.cursor()) as cr:
                 ^^^^^^^^^^^
  File "/opt/bitnami/odoo/lib/odoo-18.0.post20250205-py3.12.egg/odoo/sql_db.py", line 785, in cursor
    return Cursor(self.__pool, self.__dbname, self.__dsn)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/opt/bitnami/odoo/lib/odoo-18.0.post20250205-py3.12.egg/odoo/sql_db.py", line 288, in __init__
    self._cnx = pool.borrow(dsn)
                ^^^^^^^^^^^^^^^^
  File "/opt/bitnami/odoo/venv/lib/python3.12/site-packages/decorator.py", line 232, in fun
    return caller(func, *(extras + args), **kw)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/opt/bitnami/odoo/lib/odoo-18.0.post20250205-py3.12.egg/odoo/tools/func.py", line 97, in locked
    return func(inst, *args, **kwargs)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/opt/bitnami/odoo/lib/odoo-18.0.post20250205-py3.12.egg/odoo/sql_db.py", line 712, in borrow
    result = psycopg2.connect(
             ^^^^^^^^^^^^^^^^^
  File "/opt/bitnami/odoo/venv/lib/python3.12/site-packages/psycopg2/__init__.py", line 122, in connect
    conn = _connect(dsn, connection_factory=connection_factory, **kwasync)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
psycopg2.OperationalError: connection to server at "production-hm-odoo-postgres.xxxxxxxxxxxx.us-west-2.rds.amazonaws.com" (172.31.131.218), port 5432 failed: could not open certificate file "/root/.postgresql/postgresql.crt": Permission denied
connection to server at "production-hm-odoo-postgres.xxxxxxxxxxxx.us-west-2.rds.amazonaws.com" (172.31.131.218), port 5432 failed: FATAL:  no pg_hba.conf entry for host "172.31.157.94", user "odoo_user", database "postgres", no encryption

Additional information

I found setting rds.force_ssl = 0 in RDS helps. However, this is not a good practice. Maybe if Odoo could support sslmode=require, it will help (?)