anchor.diff:      kind: Service
       name: elasticsearch
     tls:
  -    termination: reencrypt
  -    caCertificate: |-
  +    termination: reencrypt <1>
  +    destinationCACertificate: |-   <2>
  +      -----BEGIN CERTIFICATE-----
  +      [...]
  +      -----END CERTIFICATE-----
   ----
  -
  -. Use the following commands to add the CA certificate to the object YAML file:
  -+
  -----
  -cat ./admin-ca | sed -e "s/^/      /" >> my_es_route.yaml
  -echo "    destinationCACertificate: |-" >> my_es_route.yaml
  -cat ./admin-ca | sed -e "s/^/      /" >> my_es_route.yaml
  -----
  +<1> Set the termination field to reencrypt.
  +<2> Enter the CA certificate from ElasticSearch.
   
   . Use the following command to create the service:
   +
  
positive.code: ESPOD=$( oc get pods -l component=elasticsearch -o name | sed -e "s/pod\///" )
  ----
  
  . Use the following command to extract CA certificate to a file:
  +
  ----
  oc exec $ESPOD -- cat /etc/openshift/elasticsearch/secret/admin-ca > ./admin-ca
  ----
  
  . Create the route object for the ElasticSearch service as an yaml file:
  
negative.code: oc create -f my_es_route.yaml
  ----
  
  . Check that the ElasticSearch service is exposed:
  +
  ----
  curl --silent --insecure -H "Authorization: Bearer $( oc whoami -t )" "https://$( oc get route elasticsearch -o jsonpath='{.spec.host}' ):443/.operations.*/_search" | jq
  