How to do TLS to the upstream, with Ingress resource?

I’m using an Ingress resource to define an Ingress w/ Kong. By default, Kong uses HTTP(no-S) to talk to the upstream; I’d like it to use HTTPS/TLS. Is this possible to define on the Ingress itself?

(There seems to be some annotations that I can apply to the Service, but I have less control over that as it is coming from a third-party YAML. I can probably do something like a Kustomize patch over it, but I was wondering if there was an annotation for the Ingress?)

(My upstream does HTTP → HTTPS redirecting, so it’s currently in an infinite loop, as the HTTPS request from the client is transformed into an HTTP request by Kong.)

This can only be defined on the Service, unfortunately. That’s just the way the routing model works: Ingresses/routes control downstream/client-facing behavior, and Services control the upstream/proxy target behavior.