Cert-manager works with at least Ambassador to do this, but basically any web server that can read a tls certificate from a Kubernetes secret should work with c

Cert-manager works with at least Ambassador to do this, but basically any web server that can read a tls certificate from a Kubernetes secret should work with cert-manager. Beyond that, though, there really isn't a solid "turn on TLS" option because security is hard and TLS is not a panacea. It ostensibly encourages that a client on the Internet will only send data to a domain name that currently has a matching TLS certificate (practically relying on an intricate web of trust between DNS and PKI), but that isn't even a guarantee. Web servers often still listen on port 80, clients can be forced to ignore certificate errors, and TLS does zero client-side authentication or authorization by default.