Designate need to provide the same mechanisms to support internal tls as described in https://github.com/openstack-k8s-operators/docs/blob/main/tls.md . An example can be taken e.g. from neutron:

• support tls parameters for api services https://github.com/openstack-k8s-operators/neutron-operator/pull/263
• TLS cert generation in openstack-operator https://github.com/openstack-k8s-operators/openstack-operator/pull/622 
• tls support for DB connection https://github.com/openstack-k8s-operators/neutron-operator/pull/308