TLS termination means decrypting HTTPS traffic at the cluster's entry, at the Ingress controller, which then forwards the traffic to the Pods. The certificate and its key are stored in a TLS-type Secret referenced by the Ingress; a tool such as cert-manager can renew them.
Example
tls:
- hosts: [app.example.com]
secretName: app-tls