---
schema_version: "1"
id: c8c3f60e3f85fd084e647ae90570aa02db77975bc16ede4108699d1667748d6f
title: Configuring Red Hat OpenShift Routes in Runtime Fabric
collection: mulesoft
version: current
locale: en-us
portal_url: https://docs.salesforce.com/mulesoft/current/en-us/runtime-fabric/2.7/configure-openshift-routes.md
canonical_url: https://docs.mulesoft.com/runtime-fabric/2.7/configure-openshift-routes
source_site: docs.mulesoft.com
content_type: documentation
content_hash: db28b97b091f05e2a84653781eaec144391fa2576c6336a0e75677f0ac26a8b8
description: MuleSoft Documentation Site
release: "2.7"
latest: false
---
---
product: Runtime Fabric
version: 2.7
---

# Configuring Red Hat OpenShift Routes in Runtime Fabric

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

Runtime Fabric enables you to configure Red Hat OpenShift Routes to create ingress endpoints for
your Mule applications.

## Before You Begin

Configuration of routes in Runtime Fabric follows closely to ingress resource configuration. Before
you create routes, review the following:

- [How Ingress Resources Templates Work in Runtime Fabric](https://docs.mulesoft.com/runtime-fabric/2.7/custom-ingress-configuration#how-ingress-resources-templates-work-in-runtime-fabric)

- [Example Ingress Resource Templates](https://docs.mulesoft.com/runtime-fabric/2.7/custom-ingress-configuration#example-ingress-resource-templates)

- [Creating a route through an Ingress object](https://docs.openshift.com/en/container-platform/4.10/networking/routes/route-configuration.html).

## Example Ingress Resource Template for A Red Hat OpenShift Route

The following example illustrates how to modify a Kubernetes ingress spec to create a Runtime Fabric
ingress resource template for the networking.k8s.io/v1 API.

```yaml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: example-rtf-ingress
  namespace: rtf #(1)
  labels:
spec:
  ingressClassName: rtf-openshift #(2)
  tls: #(3)
    - hosts:
        - app-name.example.com
      secretName: example-tls
  rules:
    - host: app-name.example.com #(4)
      http:
        paths: #(5)
          - pathType: Prefix
            path: / #(6)
            backend: #(7)
              service:
                name: service-name
                port:
                  name: service-port
```

Note the following about this example:

<table><tbody><tr><td><i data-value="1"></i><b>1</b></td><td>The template must be placed in the <code>rtf</code> namespace.</td></tr><tr><td><i data-value="2"></i><b>2</b></td><td><code>ingressClassName</code> must be prefixed with <code>rtf</code>-, and must be set to <code>rtf-openshift</code>.<div><p>Runtime Fabric uses the <code>rtf-</code> prefix to recognize the object as a template. Templates with <code>rtf-</code> prefix in the <code>spec.ingressClassName</code> field or in the <code>kubernetes.io/ingress.class</code> annotation are consumed by the Runtime Fabric agent only and not by the actual ingress controller. Ingress controllers discover only those resources with a <code>spec.ingressClassName</code> value that use the vendor-specific name, for example,<code>openshift</code>.</p></div></td></tr><tr><td><i data-value="3"></i><b>3</b></td><td>TLS is optional. If specified in the template, Runtime Fabric creates a route with edge termination by default unless you set the <code>route.openshift.io/termination:</code> annotation.</td></tr><tr><td><i data-value="4"></i><b>4</b></td><td>Runtime Fabric replaces the <code>app-name</code> placeholder parameter with the actual app name when you deploy the application. This helps to ensure that each endpoint name is unique if there is not a wildcard in the subdomain.</td></tr><tr><td><i data-value="5"></i><b>5</b></td><td>A template can include multiple paths for a host, but Runtime Manager displays only the first path rule for the host.</td></tr><tr><td><i data-value="6"></i><b>6</b></td><td>Runtime Fabric replaces the <code>path</code> parameter value with the value you add in the Path field when you configure ingress for a Mule application. Note that <code>path</code> is not a placeholder.</td></tr><tr><td><i data-value="7"></i><b>7</b></td><td>These placeholder values are required for Kubernetes validation, but the actual values are not used by Runtime Fabric.</td></tr></tbody></table>

For a list of optional placeholder values, see
[Template Placeholders](https://docs.mulesoft.com/runtime-fabric/2.7/custom-ingress-configuration#template-placeholders).

## Configure A Route in Runtime Fabric

To configure a route, complete the following tasks:

1.  Create an ingress resource template and apply it in the cluster.

2.  Configure ingress for a Mule application.

### Create an Ingress Resource Template and Apply it in the Cluster

Use the [example template](#example-ingress-resource-template-for-a-red-hat-openshift-route) to
create an ingress resource for a route.

1.  Copy the example template into a new file and modify it according to the notes.

2.  Include a `.yaml` extension in the file name.

3.  To apply an ingress template, run:

    ```copy
    kubectl apply -f <TEMPLATE_FILENAME.yaml>
    ```

If there is an issue in the template, Kubernetes `api-server` returns an error and the command
fails.

After you apply a template successfully, you can view it with:

```copy
kubectl describe ingress [Ingress Name] -n rtf
```

### Configure Ingress for a Mule Application

You configure ingress for an application when you deploy it to Runtime Fabric using Runtime Manager.
Available hosts and paths for an application come from the ingress resource template configured by
the Runtime Fabric administrator.

You can also use this procedure to deploy a test application to validate your ingress resource
template.

> [!NOTE] The following provides an overview of how to configure ingress for an application. Refer
> to [Deploy a Mule Application to Runtime Fabric](https://docs.mulesoft.com/runtime-fabric/2.7/deploy-to-runtime-fabric) for complete deployment
> instructions. If you are using the Mule Maven plugin to deploy applications to Runtime Fabric, the
> deployment settings parameter `publicUrl` in the block `http` can accept a comma-delimited string
> of multiple endpoints. For more information, see
> [deploymentSettings Parameters Reference](https://docs.mulesoft.com/mule-runtime/latest/deploy-to-rtf#deploymentsettings-parameters-reference).

1.  Navigate to Runtime Manager and follow the documentation to deploy an application to Runtime
    Fabric.

2.  Select **Ingress**.

3.  From the **Host** drop-down list, select a host for the application.

4.  If the hostname uses a wildcard, add a subdomain in the **Subdomain** field.

    The **Subdomain** field is only available if the hostname uses a wildcard.

5.  In the **Path** field, add a URL path to the application’s endpoint:

    ![The host and path fields are populated for the endpoint](/mulesoft/current/en-us/runtime-fabric/2.7/_images/rtf-ingress-endpoint.png)

6.  To preview the endpoint, click the generated preview link.

7.  To add additional endpoints, click **\+ Add Endpoint**.

8.  When ready, click **Deploy application**.

After you deploy the application, Runtime Manager creates a route to serve traffic to the
application as per the template specified.

## Configure Passthrough TLS Termination

You can configure the ingress resource template to include passthrough TLS termination.

For more information on configuring routes with passthrough TLS termination, refer to the
[Red Hat OpenShift documentation](https://docs.openshift.com/en/container-platform/4.10/networking/routes/route-configuration.html).

Follow these steps to create an ingress resource template:

1.  In the template, add the following annotation:

    route.openshift.io/termination: passthrough

2.  In the template, set the following parameter values:

    - `path: ''` (an empty string)

    - `pathType: ImplementationSpecific`

3.  In Runtime Manager, when configuring ingress for a Mule app, in the **Path** field include a
    `/`.

The application endpoint will show HTTPS for passthrough TLS termination.

## Configure Reencrypt Termination

You can configure the ingress resource template to include reencrypt termination by adding the
`route.openshift.io/termination: reencrypt` annotation to the template.

Follow these steps to configure reencrypt termination:

1.  Create a secret object to hold the destination CA certificate, which can be a self-signed
    certificate, or chain.  
    The following mule-app.cert file contains a PEM-encoded certificate (chain or self-signed
    certificate) of the leaf certificate used in target Mule app’s keystore.

    kubectl -nrtf create secret generic ah-destination-tls \\ --from-file=tls.crt=mule-app.cert

2.  Add a label to the secret to propagate it into the Mule app’s namespace.

    kubectl -n rtf label secret ah-destination-tls "rtf.mulesoft.com/synchronized=true""

3.  Create or delete and re-create the ingress template in Runtime Fabric namespace with the
    additional `route.openshift.io/destination-ca-certificate-secret:` annotation.

    \> cat ingress-reencrypt.yaml apiVersion: networking.k8s.io/v1 kind: Ingress metadata:
    annotations: route.openshift.io/termination: "reencrypt"
    route.openshift.io/destination-ca-certificate-secret: "ah-destination-tls" name: rtf-ingress
    namespace: rtf labels: spec: ingressClassName: rtf-openshift tls:
    - hosts:
      - app-name.andrew.com secretName: ah-tls rules:
    - host: app-name.andrew.com http: paths:
      - path: / pathType: Prefix backend: service: name: service-name port: name: service-port

4.  In Runtime Manager > Application settings, select the ingress endpoint. If the previous ingress
    endpoint exists with the same name, remove it, apply changes, then select the new ingress
    endoint and apply changes again.

5.  Check and confirm that the ingress, secret, and routes exist in the Mule app’s namespace.
    Requests should now be successful.

    kubectl -n <application\_namespace> get ingress kubectl -n <application\_namespace> get routes
    kubectl -n <application\_namespace> get secret

For example:

\> kubectl -n 82e05f0d-21d7-4808-8088-2dd132095326 get ingress NAME CLASS HOSTS ADDRESS PORTS AGE
ah-app-1-rtf-ingress <none> ah-app-1.andrew.com
router-default.apps.ah-rtf-rosa-1.9esk.p1.openshiftapps.com 80, 443 7m30s

> kubectl -n 82e05f0d-21d7-4808-8088-2dd132095326 get route NAME HOST/PORT PATH SERVICES PORT
> TERMINATION WILDCARD ah-app-1-rtf-ingress-6vhpq ah-app-1.andrew.com / ah-app-1 http
> reencrypt/Redirect None

> kubectl -n 82e05f0d-21d7-4808-8088-2dd132095326 get secret | grep -i tls ah-destination-tls Opaque
> 1 52m ah-tls kubernetes.io/tls 2 131m