Ingress with TLS

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: docktionary
  annotations:
    # Annotations are how ingress-nginx and cert-manager extend the spec --
    # neither of these fields exists in the core Ingress API itself.
    nginx.ingress.kubernetes.io/ssl-redirect: "true"
    # Tells cert-manager to request and auto-renew a cert for the hosts
    # listed under tls below, using this ClusterIssuer.
    cert-manager.io/cluster-issuer: letsencrypt-prod
spec:
  ingressClassName: nginx
  tls:
    # secretName is where cert-manager writes the issued cert -- create
    # this name here, cert-manager fills it in, nothing else to wire up.
    - hosts: ["docktionary.com"]
      secretName: docktionary-tls
  rules:
    - host: docktionary.com
      http:
        paths:
          # ingress-nginx matches by longest path prefix, not top-to-bottom
          # order -- "/api" wins over "/" for a request to /api/anything
          # regardless of which rule is listed first.
          - path: /
            pathType: Prefix
            backend:
              service:
                name: docktionary-app
                port:
                  number: 80
          - path: /api
            pathType: Prefix
            backend:
              service:
                name: docktionary-api
                port:
                  number: 80