Expose a service with ingress and TLS

This pattern keeps the service internal, puts Traefik at the edge, and forces all browser traffic through HTTPS.

Checklist

Create a `Service` that targets the workload.
Add an `Ingress` for the hostname.
Bind a `Certificate` to the same hostnames.
Add a redirect middleware so HTTP is not left open.

Example commands

kubectl apply -k manifests/app
kubectl -n k8s-oci get ingress webpages
kubectl -n k8s-oci get certificate web-tls
curl -I http://rghf.nl
curl -I https://rghf.nl

Operational note

Prefer redirecting at the ingress layer. That keeps the application image simple and makes the redirect policy visible in the cluster manifests instead of buried in app code.