An Ingress controller terminates TLS using a valid certificate. The upstream application receives HTTP from the controller. Which security conclusion is correct?

1. The TLS certificate replaces all workload authorization checks
2. Client-to-controller TLS does not by itself encrypt controller-to-backend traffic
3. The application's stored Secrets are now encrypted at rest
4. Every Pod-to-Pod connection is now mutually authenticated