How do you configure TLS termination for an OpenShift Route when you have a certificate and private key?

• A. In the Route's TLS section, set termination (edge/reencrypt/passthrough) and supply certificate and key PEM data.
• B. In the Ingress resource spec
• C. In the Deployment spec
• D. In the Pod manifest using annotations

Answer: (A)

TLS termination is configured directly on the Route resource. You specify the termination type (edge, reencrypt, or passthrough) in the Route’s TLS section and provide the PEM-encoded certificate and private key that the OpenShift router will present to clients. This is how the router handles TLS for traffic coming from outside the cluster and then routes it to the backend service.

The other resources aren’t suited for configuring how the router handles TLS. Ingress is a Kubernetes construct, not the OpenShift Route, and Deployment or Pod manifests don’t define how TLS is terminated at the router. Annotations on a Pod likewise don’t control the router’s TLS termination behavior.