thats how i do that on azure - a combination of cert-manager helm and nginx-ingress running inside the cluster