An Ingress in namespace storefront references a TLS Secret named shop-cert. Where should that Secret normally exist?

1. Only in namespace kube-system, regardless of the Ingress namespace
2. In namespace storefront
3. In any namespace if the Secret has the same label
4. Only in the controller's local filesystem, with no Secret object