<p>I need to apply certificate in the solution after the solution has been deployed.As ambassador listen to the change in tls secret I took this approach.After my application has been deployed my ambassador uses a default self signed certificate.I updated that certificate with this command </p>

<pre><code>kubectl create secret tls ambassador-tls-secret \
     --cert=/root/tls.crt --key=/root/tls.key  --dry-run -o yaml | 
  kubectl apply -f -


</code></pre>

<p>My secret has now been updated but my Ambassador still doesnt listen to the new secret.
Is there something wrong with the way I have updated my secret ?</p>

avinashjha
<p>You can configure Ambassador to terminate TLS with either a <code>TLSContext</code> or tls <code>Module</code> resource. To get either to simply terminate TLS using the secret you created, you can configure them like</p>

<p>tls <code>Module</code>:</p>

<pre><code>---
apiVersion: ambassador/v1
kind: Module
name: tls
config:
  server:
    enabled: true
    secret: ambassador-tls-secret
</code></pre>

<p><code>TLSContext</code>:</p>

<pre><code>---
apiVersion: ambassador/v1
kind: TLSContext
name: ambassador
secret: ambassador-tls-secret
hosts: ["*"]
</code></pre>

<p>After configuring either of these, Ambassador should notice the <code>ambassador-tls-secret</code> you created and use the certificates for tls termination. </p>

<p>You can verify Ambassador has been configured correctly by checking the <code>envoy.json</code> configuration file in the Ambassador container</p>

<pre><code>kubectl exec -it {AMBASSADOR_POD_NAME} -- cat envoy/envoy.json
</code></pre>

<p>If Ambassador has been correctly configured, you should see an Envoy <code>tls_context</code> configured and the listener named <code>ambassador-listener-8443</code> like below:</p>

<pre><code>                        "tls_context": {
                            "common_tls_context": {
                                "tls_certificates": [
                                    {
                                        "certificate_chain": {
                                            "filename": "/ambassador/snapshots/default/secrets-decoded/ambassador-certs/66877DCC8C7B7AF190D3510AE5B4BFC71FADB308.crt"
                                        },
                                        "private_key": {
                                            "filename": "/ambassador/snapshots/default/secrets-decoded/ambassador-certs/66877DCC8C7B7AF190D3510AE5B4BFC71FADB308.key"
                                        }
                                    }
                                ]
                            }
                        },
                        "use_proxy_proto": false
                    }
                ],
                "name": "ambassador-listener-8443"
</code></pre>

<p>If you do not, then Ambassador has rejected your config for some reason. Check the logs of the Ambassador container, ensure you have only a tls <code>Module</code> <strong>or</strong> <code>TLSContext</code> configured, check to see if <code>service_port</code> has been configured in an <a href="https://www.getambassador.io/reference/core/ambassador" rel="nofollow noreferrer">ambassador Module</a>, and ensure you have the correct <a href="https://www.getambassador.io/reference/running#ambassador_id" rel="nofollow noreferrer">ambassador_id</a>.</p>
