curl: (35) OpenSSL SSL_connect: SSL_ERROR_SYSCALL in connection to le-hotels-k8s.com:443 after curl -v https://example.com

The error you're experiencing, "OpenSSL SSL_connect: SSL_ERROR_SYSCALL in connection to le-hotels-k8s.com:443," indicates an intermittent SSL/TLS connection issue. This type of error typically occurs when the SSL/TLS handshake process is interrupted or fails to complete.

Several potential causes could be behind this intermittent behavior:

1. Load Balancer Configuration: Your load balancer might be experiencing issues with SSL termination or connection handling. This could be due to misconfigured security policies, cipher suites, or TLS versions.

2. Network Issues: Intermittent network connectivity problems between the client and the load balancer could cause connection resets during the SSL handshake.

3. Pod Health: Without proper readiness and liveness probes, unhealthy pods might receive traffic and fail to properly handle connections, causing the load balancer to reset connections.

4. Resource Constraints: Your pods might be experiencing resource constraints (CPU/memory) during high traffic periods, causing them to respond slowly or drop connections.

5. Connection Timeouts: The load balancer might have aggressive timeout settings that close connections before they complete.

To troubleshoot this issue:

1. Implement Health Checks: Add readiness and liveness probes to your Kubernetes deployments to ensure traffic is only routed to healthy pods.

2. Check Load Balancer Metrics: Monitor your load balancer for elevated processing times, connection errors, or rejected connections.

3. Packet Capture: Use tools like tcpdump or Wireshark to capture the SSL/TLS handshake process and identify where exactly the failure occurs.

4. Test TLS Configuration: Use OpenSSL to manually test the TLS connection:

openssl s_client -connect le-hotels-k8s.com:443

5. Review Pod Logs: Check your application logs for any errors that coincide with the connection failures.

6. Monitor Resource Usage: Ensure your pods have sufficient resources allocated and aren't being terminated due to OOM (Out of Memory) issues.

7. Check Certificate Configuration: Verify that your SSL/TLS certificates are properly configured and not expiring.

Since the issue is intermittent, it's likely related to either resource constraints, network issues, or load balancer configuration rather than a fundamental problem with your certificates or HTTPS setup.
Sources
OpenSSL SSL_read: Connection reset by peer, errno 104 | AWS re:Post
Why do SSL/TLS negotiation errors occur when connecting to an Application Load Balancer over HTTPS, and how can I identify the responsible client IP? | AWS re:Post
Troubleshoot your Application Load Balancers - Elastic Load Balancing