kubectl create secret tls foo-secret --key /tmp/tls.key --cert /tmp/tls.crt

ingress.yaml
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: $HOST
  annotations:
    kubernetes.io/ingress.class: "nginx"   
spec:
  tls:
  - hosts:
    - $HOST
    secretName: tls-$HOST
  rules:
  - host: $HOST
    http:
      paths:
      - path: /
        backend:
          serviceName: $SERVICE_NAME
          servicePort: $SERVICE_PORT
​