instruction: Create a Kubernetes Ingress configuration with best practices
output: ```dockerfile
  from a certificate that contains a Common
  Name (CN), also known as a Fully Qualified Domain Name (FQDN) for https-example.foo.com.
  
  Note: Keep in mind that TLS will not work on the default rule because the
  certificates would have to be issued for all the possible sub-domains. Therefore,
  hosts in the tls section need to explicitly match the host in the rules
  section.
  
  service/networking/tls-example-ingress.yaml
  
  apiVersion: networking.k8s.io/v1
  kind: Ingress
  metadata:
   name: tls-example-ingress
  spec:
   tls:
   - hosts:
   - https-example.foo.com
   secretName: testsecret-tls
   rules:
   - host: https-example.foo.com
   http:
   paths:
   - path: /
   pathType: Prefix
   backend:
   service:
   name: service1
   port:
   number: 80
  
  Note: There is a gap between TLS features supported by various Ingress
  controllers. Please refer to documentation on
  nginx,
  GCE, or any other
  platform specific Ingress controller to understand how TLS works in your environment.
  
  Load balancing
  An Ingress controller is bootstrapped with some load balancing policy settings
  that it applies to all Ingress, such as the load balancing algorithm, backend
  weight scheme, and others. More advanced load balancing concepts
  (e.g. persistent sessions, dynamic weights) are not yet exposed through the
  Ingress. You can instead get these features through the load balancer used for
  a Service.
  It's also worth noting that even though health checks are not exposed directly
  through the Ingress, there exist parallel concepts in Kubernetes such as
  readiness probes
  that allow you to achieve the same end result. Please review the controller
  specific documentation to see how they handle health checks (for example:
  nginx, or
  GCE).
  Updating an Ingress
  To update an existing Ingress to add a new Host, you can update it by editing the resource:
  kubectl describe ingress test
  Name: test
  Namespace: default
  Address: 178.91.123.132
  Default backend: default-http-backend:80 (10.8.2.3:8080)
  Rules:
   Host Path Backends
   ---- ---- --------
   foo.bar.com
   /foo service1:80 (10.8.0.90:80)
  Annotations:
   nginx.ingress.kubernetes.io/rewrite-target: /
  Events:
   Type Reason Age
  ```