Intermittent 503 errors with passthrough routes - Client Hello timeout not missing SNI

Issue

Intermittent 503 Service Unavailable errors occur when accessing applications through TLS routes (passthrough or edge-terminated) in OpenShift. The issue presents as two distinct symptoms:

1. 503 Service Unavailable errors - This HTTP status code typically indicates the backend service is not running or unavailable, but in this case the backend pods are healthy, running without restarts, and serving traffic successfully at other times.

2. HAProxy router access logs showing fe_no_sni~ and <NOSRV> backend - This suggests Server Name Indication (SNI) is missing from the TLS Client Hello packet. But checking the packet capture, the SNI is not missing from client hello calls.

   Example Router (HAProxy) log entry:

   2025-12-04T04:35:31.985979+00:00 router-default-xxx-xxx haproxy[23]: 10.nnn.nnn.nnn:42072 [04/Dec/2025:04:35:31.985] fe_no_sni~ openshift_default/<NOSRV> 0/-1/-1/-1/0 503 2655 - - SC-- 260/31/0/0/0 0/0 "POST /system/api/endpoint/v1 HTTP/1.1"
   

Both symptoms are misleading. The backend service is available, and SNI is present in the Client Hello but it fails to pass the packet to the the correct application workload.