A civic portal Ingress must terminate HTTPS for host portal.city.example using an existing TLS certificate stored in the cluster. Where should the Ingress reference that material?
Select an answer to reveal the explanation.
Short Explanation
HTTPS on Ingress needs a named envelope for cert and key. The Ingress tls block lists the host and the Secret that stores those files. Stuffing certs into Service externalIPs or securityContext fields is the wrong shelf.
Full Explanation
Ingress TLS configuration references a Secret (typically type kubernetes.io/tls) by name under spec.tls, along with the hosts that certificate covers. The Ingress controller uses that Secret to terminate HTTPS. securityContext, Service externalIPs, and kube-proxy mode annotations are unrelated to binding TLS material for Ingress hosts.