From d5231340800a6ad83e44822773d730dd514a42b6 Mon Sep 17 00:00:00 2001
From: xueli <xueli@redhat.com>
Date: Mon, 9 Mar 2026 16:44:18 +0800
Subject: [PATCH] HYPERFLEET-730 - fix: copy CA certificates from builder stage
 to ubi9-micro runtime

ubi9-micro doesn't include ca-certificates, causing TLS failures
(x509: certificate signed by unknown authority) when connecting to
external services like Google Pub/Sub. Copy the CA trust bundle from
the builder stage to fix this.
---
 Dockerfile | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/Dockerfile b/Dockerfile
index 99e680cd..4e8ae711 100755
--- a/Dockerfile
+++ b/Dockerfile
@@ -40,6 +40,8 @@ FROM ${BASE_IMAGE}
 
 WORKDIR /app
 
+# ubi9-micro doesn't include CA certificates; copy from builder for TLS (e.g. Google Pub/Sub)
+COPY --from=builder /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem
 COPY --from=builder /build/bin/hyperfleet-api /app/hyperfleet-api
 COPY --from=builder /build/openapi/openapi.yaml /app/openapi/openapi.yaml