How would you suggest provisioning an external WAF such as Azure/AWS/CF when TLS termination happens in the ingress-controller & cert-manager is responsible of producing and renewing all of the certificates?