EG ingress: end-to-end TLS

[zhaohuabing]

Could we document a way to enable this? Possibly as a follow-up; it would be great to support end-to-end TLS, but I think this PR is a good first step.

Originally posted by @TaylorMutch in #2015 (comment)

[zhaohuabing]

/assign