Reencrypt Argo CD server Route missing destinationCACertificate can return 503 Application is not available #2373

Describe the bug

On OpenShift, the operator defaults the Argo CD server Route to reencrypt but does not set spec.tls.destinationCACertificate. When the OpenShift router cannot verify the backend serving certificate, HAProxy returns HTTP 503 with the OpenShift page Application is not available, even though the Argo CD server pod is healthy and reachable by pod IP.

This has been seen with OpenShift GitOps 1.16+ / OCP 4.14+ (including ROSA). Recreating the Argo CD CR or Route can temporarily recover the Route because the router state is rebuilt, but the generated Route still omits the destination CA.

Expected behavior

For reencrypt Routes, the operator should populate destinationCACertificate from the OpenShift Service CA (unless the user already set .spec.server.route.tls.destinationCACertificate).

Additional context

• Red Hat KCS: https://access.redhat.com/solutions/7134699
• Related: GITOPS-8248, OCPBUGS-91641
• Ingress engineering confirmed HAProxy requires a destination CA to verify the backend cert on reencrypt Routes.