<p>I see that normally a new image is created, that is, a dockerfile, but is it a good practice to pass the cert through environment variables? with a batch that picks it up and places it inside the container</p>
<p>Another approach I see is to mount the certificate on a volume.</p>
<p>What would be the best approximation to have a single image for all environments?
Just like what happens with software artifacts, I mean.</p>
<p>Creating a new image for each environment or renewal I find it tedious, but if it has to be like this...</p>

<p>Definitely do <strong>not</strong> bake certificates into the image.</p>
<p>Because you tagged your question with <code>azure-aks</code>, I recommend using the Secrets Store CSI Driver to mount your certificates from Key Vault.</p>
<ul>
<li>See the <a href="https://github.com/Azure/secrets-store-csi-driver-provider-azure" rel="nofollow noreferrer">plugin project page on GitHub</a></li>
<li>See also this doc <a href="https://azure.github.io/secrets-store-csi-driver-provider-azure/docs/configurations/getting-certs-and-keys/" rel="nofollow noreferrer">Getting Certificates and Keys using Azure Key Vault Provider</a></li>
<li>This doc is better, more thorough and worth going through even if you're not using the nginx ingress controller <a href="https://azure.github.io/secrets-store-csi-driver-provider-azure/docs/configurations/ingress-tls/" rel="nofollow noreferrer">Enable NGINX Ingress Controller with TLS</a></li>
</ul>
<p>And so for different environments, you'd pull in different certificates from one or more key vaults and mount them to your cluster. Please also remember to use different credentials/identities to grab those certs.</p>
