---
title: "Routes, Networking & TLS/SSL"
canonical: "https://kb.uconn.edu/space/IKB/28728557628/Routes%2C%20Networking%20%26%20TLS%2FSSL"
format: markdown
---
OpenShift uses **Routes** to expose your applications to the outside world. This guide covers creating routes, enabling HTTPS with TLS, and configuring networking between services.

---

## How Networking Works in OpenShift

| Component | Purpose | Scope |
| --- | --- | --- |
| **Pod IP** | Internal address for a single pod | Within the pod only |
| **Service** | Stable internal DNS name for a group of pods | Within the cluster |
| **Route** | External URL that maps to a Service | Public internet |

> **Key concept:** A Service provides a stable internal endpoint (e.g., `my-app.my-project.svc`). A Route maps an external hostname to that Service.

---

## Creating a Route

### Basic Route (HTTP)

```shell
# Expose a service with an auto-generated hostname
oc expose service/my-app

# Get the route URL
oc get route my-app

# Expose with a custom hostname
oc expose service/my-app --hostname=myapp.apps.opp.its.uconn.edu
```

### View All Routes

```shell
oc get routes
```

| Field | Description |
| --- | --- |
| **NAME** | Route name |
| **HOST/PORT** | The external URL |
| **SERVICES** | The backend Service |
| **PORT** | Target port on the Service |
| **TERMINATION** | TLS termination type (if any) |

---

## Enabling HTTPS with TLS

By default, routes use HTTP. To enable HTTPS, you need to configure TLS termination.

### Edge Termination (Most Common)

TLS is terminated at the router. Traffic between the router and your app is unencrypted (but stays within the cluster).

```shell
# Create an edge-terminated route (uses OpenShift's default wildcard certificate)
oc create route edge my-app-https \
  --service=my-app \
  --port=8080

# With a custom certificate
oc create route edge my-app-https \
  --service=my-app \
  --cert=cert.pem \
  --key=key.pem \
  --port=8080
```

### Passthrough Termination

TLS is handled by your application directly. The router passes encrypted traffic through without decrypting it.

```shell
oc create route passthrough my-app-tls \
  --service=my-app \
  --port=8443
```

### Re-encrypt Termination

TLS is terminated at the router and re-encrypted to the backend. Use this when your app requires end-to-end encryption.

```shell
oc create route reencrypt my-app-reencrypt \
  --service=my-app \
  --cert=edge-cert.pem \
  --key=edge-key.pem \
  --dest-ca-cert=app-ca.pem \
  --port=8443
```

---

## TLS Termination Comparison

| Type | Encrypted to Router | Encrypted to App | Use Case |
| --- | --- | --- | --- |
| **Edge** | Yes | No | Standard HTTPS websites and APIs |
| **Passthrough** | Yes | Yes | App manages its own certificates |
| **Re-encrypt** | Yes | Yes | End-to-end encryption with router certificate control |

> **Recommendation:** For most UConn applications, **edge termination** is the simplest and most appropriate choice. OpenShift's default wildcard certificate covers `*.apps.opp.its.uconn.edu`.

---

## Forcing HTTPS (Redirect HTTP to HTTPS)

```shell
# Create a route that redirects HTTP to HTTPS
oc create route edge my-app-https \
  --service=my-app \
  --insecure-policy=Redirect \
  --port=8080
```

| Insecure Policy | Behavior |
| --- | --- |
| `Redirect` | HTTP requests are redirected to HTTPS (recommended) |
| `Allow` | Both HTTP and HTTPS are allowed |
| `None` | HTTP requests are rejected (default) |

---

## Service-to-Service Communication

Within the cluster, services communicate using internal DNS names — no routes needed.

```shell
# Format: <service-name>.<project-name>.svc.cluster.local
# Shorthand within same project: <service-name>

# Example: connecting to a database service
DATABASE_URL=postgres://db-service.my-project.svc:5432/mydb

# Example: calling another microservice
API_URL=http://api-service:8080/v1/data
```

---

## Troubleshooting Routes

| Symptom | Cause | Fix |
| --- | --- | --- |
| Route returns 503 | No healthy pods behind the service | Check pod status with `oc get pods` |
| Route returns 404 | App not listening on the expected port | Verify target port matches your app's listening port |
| HTTPS not working | No TLS termination configured | Create an edge route with TLS |
| Custom hostname not resolving | DNS not configured | Contact ITS to set up DNS for custom hostnames |
| Intermittent 502 errors | Pod restarts during traffic | Add health checks and increase replica count |

---

*UConn ITS Infrastructure Services — OpenShift Knowledge Base*