<p>Can anyone pls help me with Open-Shift Routes?</p>

<p>I have set up a Route with Reencrypt TLS termination. Calls made to the service endpoint (<a href="https://openshift-pmi-dev-reencrypt-default.apps.vapidly.os.fyre.ibm.com" rel="nofollow noreferrer">https://openshift-pmi-dev-reencrypt-default.apps.vapidly.os.fyre.ibm.com</a>) results in:</p>

<p><a href="https://i.stack.imgur.com/Ww8ST.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/Ww8ST.png" alt="enter image description here"></a></p>

<p>Requests made to the URL does not seem to reach the pods, it is returning a 503 Application not available error. The liberty application is running fine on port 8543, application logs looks clean. </p>

<p>I am unable to identify the root cause of this error, The requests made on external https URLs does not make it to the application pod. Any suggestions on how to get the endpoint url's working?</p>

<p>Thanks for your help in advance!</p>

<p>Openshift version 4.2
Liberty version 19</p>

<p><strong>Route.yaml</strong></p>

<pre><code>kind: Route
apiVersion: route.openshift.io/v1
metadata:
  name: openshift-pmi-dev-reencrypt
  namespace: default
  selfLink: &gt;-
    /apis/route.openshift.io/v1/namespaces/default/routes/openshift-pmi-dev-reencrypt
  uid: 5de29e0d-16b6-11ea-a1ab-0a580afe00ab
  resourceVersion: '7059134'
  creationTimestamp: '2019-12-04T16:51:50Z'
  labels:
    app: apm-pm-api
  annotations:
    openshift.io/host.generated: 'true'
spec:
  host: openshift-pmi-dev-reencrypt-default.apps.vapidly.os.fyre.ibm.com
  subdomain: ''
  path: /ibm/pmi/service
  to:
    kind: Service
    name: apm-pm-api-service
    weight: 100
  port:
    targetPort: https
  tls:
    termination: reencrypt
    insecureEdgeTerminationPolicy: None
  wildcardPolicy: None
status:
  ingress:
    - host: openshift-pmi-dev-reencrypt-default.apps.vapidly.os.fyre.ibm.com
      routerName: default
      conditions:
        - type: Admitted
          status: 'True'
          lastTransitionTime: '2019-12-04T16:51:50Z'
      wildcardPolicy: None
      routerCanonicalHostname: apps.vapidly.os.fyre.ibm.com


</code></pre>

<p><strong>Service.yaml</strong></p>

<pre><code>kind: Service
apiVersion: v1
metadata:
  name: apm-pm-api-service
  namespace: default
  selfLink: /api/v1/namespaces/default/services/apm-pm-api-service
  uid: 989040ed-166c-11ea-b792-00000a1003d7
  resourceVersion: '7062857'
  creationTimestamp: '2019-12-04T08:03:46Z'
  labels:
    app: apm-pm-api
spec:
  ports:
    - name: https
      protocol: TCP
      port: 443
      targetPort: 8543
  selector:
    app: apm-pm-api
  clusterIP: 172.30.122.233
  type: ClusterIP
  sessionAffinity: None
status:
  loadBalancer: {}


</code></pre>

<p>Looking at the snapshot, the browser is stating "Not Secure" for the connection. Is this an attempt to access the application over HTTP, not HTTPS?</p>

<p>Having <code>spec.tls.insecureEdgeTerminationPolicy: None</code> means that traffic on insecure schemes (HTTP) is disabled - see the "Re-encryption Termination" section in <a href="https://docs.openshift.com/container-platform/3.11/architecture/networking/routes.html" rel="nofollow noreferrer">this doc</a>.</p>

<p>I'd suggest to also use that documentation to determine if you may need to configure <code>spec.tls.destinationCACertificate</code>.</p>
