How should TLS termination be designed for production in Ingress?

Automate certificate issuance and rotation, use modern TLS policy, and use re-encryption or service mesh mTLS when internal threat models require it.