Rebuild an Ingress as a Gateway plus an HTTPRoute, keep HTTPS working, then delete the Ingress — the order matters.

50% CPU across one to four replicas, a 30-second downscale window — and resource requests before any of it works.

An NGINX Deployment must accept TLSv1.3 and refuse TLSv1.2. Editing the ConfigMap is the easy half; the restart is the exam.