A cert-manager style Certificate custom resource produces a TLS Secret. How should an application Ingress typically consume that output?
Select an answer to reveal the explanation.
Short Explanation
Think of the Certificate as the work order and the TLS Secret as the finished badge. You don't hand the Ingress the work order; you point its tls block at the Secret name where cert-manager dropped the certificate and key. Rotation then happens behind the scenes without touching your Pods or images.
Full Explanation
A cert-manager Certificate resource is a request: cert-manager obtains the certificate from an Issuer and writes the signed certificate and private key into the Kubernetes Secret named in the Certificate's secretName field. The Ingress consumes that output by listing the Secret name under spec.tls together with the hosts it covers, and the ingress controller reads the tls.crt and tls.key keys from that Secret to terminate HTTPS. Because the Secret is updated in place on renewal, the controller picks up the new certificate without any change to the Ingress or the workloads. Mounting the Certificate manifest as a ConfigMap on every Pod fails because the manifest is only a specification, not PEM certificate and key material, and Pods behind an Ingress do not terminate its TLS anyway. Copying the Certificate resource into container images at build time fails because certificates would go stale inside images, rotation would require rebuilds, and the resource text still contains no key material. Annotating the Certificate with an ingress class so kube-proxy terminates TLS fails because kube-proxy programs Service forwarding rules and never terminates TLS; the ingress controller does. Exam caveat: cert-manager's ingress-shim can also create the Certificate for you from annotations on the Ingress, but the Ingress still names the Secret in spec.tls. Operational check: run kubectl get certificate to confirm Ready is True, confirm the Secret named in the Ingress tls section exists with tls.crt and tls.key, then test the hostname over HTTPS.