<p>I have a container with IBM MQ (Docker image <code>ibmcom/mq/9.2.2.0-r1</code>) exposing two ports (9443 - admin, 1414 - application).</p>
<p>All required setup in OpenShift is done (Pod, Service, Routes).</p>
<p>There are two routes, one for each port.</p>
<ul>
<li><a href="https://route-admin.my.domain" rel="nofollow noreferrer">https://route-admin.my.domain</a></li>
<li><a href="https://route-app.my.domain" rel="nofollow noreferrer">https://route-app.my.domain</a></li>
</ul>
<p>pointing to the ports accordingly (external ports are default http=80, https=443).</p>
<p>Admin console is accessible through the first route, hence, MQ is up and running.</p>
<p>I tried to connect as a client (JMS 2.0, <code>com.ibm.mq.allclient:9.2.2.0</code>) using standard approach:</p>
<pre><code>  var fctFactory = JmsFactoryFactory.getInstance(WMQConstants.WMQ_PROVIDER);
  var conFactory = fctFactory.createConnectionFactory();

  // ... other props

  conFactory.setObjectProperty(WMQConstants.WMQ_HOST_NAME, &quot;route-app.my.domain&quot;);
  conFactory.setObjectProperty(WMQConstants.WMQ_PORT, 443);
</code></pre>
<p>and failed to connect. Also tried to redefine route as HTTP and use port 80, and again without success.</p>
<p>If it helps let's assume we use the latest version of MQ Explorer as a client.</p>
<p>Each time the same connection error appears:</p>
<pre><code>...
Caused by: com.ibm.mq.MQException: JMSCMQ0001: 
           IBM MQ call failed with compcode '2' ('MQCC_FAILED') reason '2009' ('MQRC_CONNECTION_BROKEN').
... 
Caused by: com.ibm.mq.jmqi.JmqiException: 
           CC=2;RC=2009;AMQ9204: Connection to host 'route-app.my.domain(443)' rejected.
           [1=com.ibm.mq.jmqi.JmqiException[CC=2;RC=2009;AMQ9208: 
            Error on receive from host 'route-app.my.domain/10.227.248.2:443 (route-app.my.domain)'.
           [1=-1,2=ffffffff,3=route-app.my.domain/10.227.248.2:443 (route-app.my.domain),4=TCP]],
            3=route-app.my.domain(443),5=RemoteConnection.receiveTSH]
...
Caused by: com.ibm.mq.jmqi.JmqiException: CC=2;RC=2009;AMQ9208: 
           Error on receive from host 'route-app.my.domain/10.227.248.2:443
</code></pre>
<p>Maybe, this <a href="https://www.ibm.com/support/pages/mq-connection-terminating-error-code-2009" rel="nofollow noreferrer">article</a> could give some hints about error code 2009, but still not sure what exactly affects connection errors from the OpenShift side.</p>
<p>Previously, I always connected to IBM MQ specifying a port value explicitly, but here is a bit different situation.<br />
<strong>How to connect to IBM MQ in OpenShift cluster through TCP?</strong></p>
<hr />
<p>Configurations in OpenShift are as follows:</p>
<hr />
<pre><code>kind: Pod
apiVersion: v1
metadata:
  name: ibm-mq
  labels:
    app: ibm-mq
spec:
  containers:
    - resources:
        limits:
          cpu: '1'
          memory: 600Mi
        requests:
          cpu: '1'
          memory: 600Mi
      name: ibm-mq
      ports:
        - containerPort: 1414
          protocol: TCP
        - containerPort: 9443
          protocol: TCP
  containerStatuses:
      image: 'nexus-ci/docker-lib/ibm_mq:latest'

---
   
kind: Service
apiVersion: v1
metadata:
  name: ibm-mq
spec:
  ports:
    - name: admin
      protocol: TCP
      port: 9443
      targetPort: 9443
    - name: application
      protocol: TCP
      port: 1414
      targetPort: 1414
  selector:
    app: ibm-mq

---

kind: Route
apiVersion: route.openshift.io/v1
metadata:
  name: ibm-mq-admin
spec:
  host: ibm-mq-admin.my-domain.com
  to:
    kind: Service
    name: ibm-mq
    weight: 100
  port:
    targetPort: admin
  tls:
    termination: passthrough
    insecureEdgeTerminationPolicy: None
  wildcardPolicy: None

---

kind: Route
apiVersion: route.openshift.io/v1
metadata:
  name: ibm-mq-app
spec:
  host: ibm-mq-app.my-domain.com
  to:
    kind: Service
    name: ibm-mq
    weight: 100
  port:
    targetPort: application
  tls:
    termination: passthrough
    insecureEdgeTerminationPolicy: None
  wildcardPolicy: None

---
</code></pre>
<p><strong>UPDATE:</strong> Ended up with creating and deploying to OpenShift a small web-application receiving HTTP requests and interacting with MQ via JMS (put/get text messages), like:</p>
<ul>
<li><code>POST /queue/{queueName}/send + &lt;body&gt;</code>;</li>
<li><code>GET /queue/{queueName}/receive</code>.</li>
</ul>
<p>It interacts with MQ inside the OpenShift cluster using TCP, and accepts external HTTP connections as a regular web application.<br />
Other solutions seem to take too much efforts, but I accepted one of them as it is theoretically correct and straightforward.</p>

<p>I'm not sure to fully understand your setup, but<code>&quot;Routes&quot;</code>only route HTTP traffic (On ports 80 or 443 onyl), not TCP traffic.<br />
If you want to access your MQ server from outside the cluster, there are a few solutions, one is to create a service of type: <code>&quot;NodePort&quot;</code></p>
<p>Doc: <a href="https://docs.openshift.com/container-platform/4.7/networking/configuring_ingress_cluster_traffic/configuring-ingress-cluster-traffic-nodeport.html" rel="nofollow noreferrer">https://docs.openshift.com/container-platform/4.7/networking/configuring_ingress_cluster_traffic/configuring-ingress-cluster-traffic-nodeport.html</a></p>
<p>Your Service is not a NodePort Service. In your case, it should be something like</p>
<pre><code>kind: Service
apiVersion: v1
metadata:
  name: ibm-mq
spec:
  type: NodePort
  ports:
    - port: 1414
      targetPort: 1414
      nodePort: 30001
  selector:
    app: ibm-mq
</code></pre>
<p>Then access from outside with anyname.&lt;cluster domaine&gt;:30001<br />
And delete the useless corresponding route. As said before, I assumed you read in the doc I pointed to you that says that route only route HTTP traffic on port 80 or 443.</p>
<p>Doc: <a href="https://kubernetes.io/docs/concepts/services-networking/service/#nodeport" rel="nofollow noreferrer">https://kubernetes.io/docs/concepts/services-networking/service/#nodeport</a></p>
