How do you associate a TLS certificate with an OpenShift Route to enable HTTPS?

• A. Create a secret of type kubernetes.io/tls containing tls.crt and tls.key; reference this secret in Route.spec.tls.secret and set termination type to edge/reencrypt.
• B. Upload the certificate directly to the Route's metadata.
• C. Store the certificate in a ConfigMap and reference in the Route.
• D. Use a global TLS secret at the cluster level.

Answer: (A)

To enable HTTPS on an OpenShift Route, the router must have access to the certificate and private key. The way to do this is to store the TLS material in a Secret of type kubernetes.io/tls inside the same project as the Route, containing the certificate (tls.crt) and the private key (tls.key). Then you configure the Route to use that secret by specifying the TLS settings and choosing a termination type such as edge or reencrypt. With edge termination, the router handles TLS termination and forwards plain HTTP to the backend; with reencrypt termination, the router terminates TLS and re-encrypts the connection to the backend. In both cases, the certificate is supplied via the TLS secret attached to the Route.

Other approaches don’t fit because TLS material must be stored as a Secret, not in the Route’s metadata or in a ConfigMap, and there isn’t a cluster-wide global TLS secret for Routes to reference.