Check out the new cluster, workloads, and services. Notice that the tls-ingress may remain yellow for some time til becoming green. Once Green, capture its public ip-address (ephemeral) and browse in another tab. This will confirm that the application is installed with self-signed certificates.
Please have the valid DNS hostname for this server. You will need to a reserved a static IP address and create an A record in your DNS provider account. For the following case, the DNS A record will be as follows (master/parent domain: trillo.io)
A gke 22.214.171.124
For managed certificates, if you need further configuration then please consult this link - https://geekflare.com/google-managed-certificate-lb/