dependency-track/apiserver in Kubernetes hangs at startup

[mrh-chain]

I'm trying to deploy Dependency Track in a Kubernetes cluster and the APIServer simply refuses to serve any requests.

For various reasons I can't use the helmchart, so I've implemented a Deployment using the settings from the helmchart like this:

 apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: deptrack-backend
   namespace: something
   labels:
     app: deptrack-backend
     key/service: deptrack-backend
   annotations:
     key: value
 spec:
   replicas: 1
   selector:
     matchLabels:
       app: deptrack-backend
   template:
     metadata:
       labels:
         app: deptrack-backend
         tkey/service: deptrack-backend
       annotations:
         key: value
     spec:
       hostPID: false
       hostIPC: false
       topologySpreadConstraints:
         - maxSkew: 1
           topologyKey: 'kubernetes.io/hostname'
           whenUnsatisfiable: DoNotSchedule
           labelSelector:
             matchLabels:
               app: deptrack-backend
       serviceAccountName: deptrack
       automountServiceAccountToken: false
       initContainers:
         - name: cert-creator
           image: customRegistryAddress/alpine:3
           imagePullPolicy: Always
           command: ['sh', '-c']
           args:
           - |
             set -x
             apk add openssl
             mkdir -p /opt/tls
             openssl req -x509 -nodes -days 3650 -newkey ec -pkeyopt ec_paramgen_curve:secp384r1 -keyout /opt/tls/server.key -out /opt/tls/server.crt -subj /CN=localhost
             chown -R 1000:1000 /opt/tls
           volumeMounts:
             - name: certs
               mountPath: /opt
           resources:
             requests:
               memory: 550Mi
               cpu: 100m
             limits:
               memory: 550Mi
       securityContext:
         fsGroup: 1000
       containers:
         - name: deptrack-backend
           image: customRegistryAddress/dependencytrack/apiserver
           imagePullPolicy: Always
           securityContext:
             readOnlyRootFilesystem: true
             capabilities:
               drop: ['ALL']
             allowPrivilegeEscalation: false
             runAsNonRoot: true
             seccompProfile:
               type: RuntimeDefault
           ports:
             - name: http
               containerPort: 8080
           livenessProbe:
             failureThreshold: 3
             httpGet:
               path: /health/live
               port: 8080
             initialDelaySeconds: 10
             periodSeconds: 10
             successThreshold: 1
             timeoutSeconds: 20
           readinessProbe:
             failureThreshold: 3
             httpGet:
               path: /health/ready
               port: 8080
             initialDelaySeconds: 10
             periodSeconds: 10
             successThreshold: 1
             timeoutSeconds: 20
           resources:
             requests:
               memory: 5Gi
               cpu: "2"
             limits:
               memory: 7Gi
           volumeMounts:
           - mountPath: /tmp
             name: tmp
           - name: certs
             mountPath: /opt/tls
           env:
           - name: TLS_CERT_FILE_PATH
             value: "/opt/tls/server.crt"
           - name: TLS_KEY_FILE_PATH
             value: "/opt/tls/server.key"
           - name: ALPINE_DATABASE_MODE
             value: "external"
           - name: ALPINE_DATABASE_URL
             value: "jdbc:postgresql://someaddress:5432/dbname"
           - name: ALPINE_DATABASE_DRIVER
             value: "org.postgresql.Driver"
           - name: ALPINE_DATABASE_USERNAME
             valueFrom:
               secretKeyRef:
                 name: deptrack-postgres
                 key: username
           - name: ALPINE_DATABASE_PASSWORD
             valueFrom:
               secretKeyRef:
                 name: deptrack-postgres
                 key: password
       volumes:
       - name: tmp
         emptyDir:
           medium: Memory
           sizeLimit: 100Mi
       - name: certs
         emptyDir:
           medium: Memory
           sizeLimit: 10Mi

As the pod is scheduled and started, it appears the APIServer gets stuck after initializing the embedded Jetty server. Any requests to the server responds in a 503. Because of liveness and readiness probes, the pod is restarted due to the 503's.

The pod logs are:

2025-04-10 13:14:24,380 INFO [EmbeddedJettyServer] alpine-executable-war v3.2.0 (e93877d0-df20-4fb1-94d1-18aaaff5eb24) built on: 2025-04-02T10:25:57Z
Shutting down application

(The shutting down application happens as a result of the liveness check).

Any idea what could be causing the APIServer to not start properly?