Ingress route vs tags for TLS and consul service

I am trying to work out how to create a route that uses a kubernetes certificate for TLS. If I create an IngressRoute I can add the kubernetes secret for TLS, but it uses the kubernetes service. If use the service tag approach I can use the consul service but I don't know how to use the kubernetes certificate secret.

Does anybody have an example of how to do either?