Certificate Deletion Policy for Finer Grained Control of Secret Cleanup about cert-manager HOT 1 OPEN

https://cert-manager.io/docs/usage/csi-driver/#why-use-csi-driver could be alternative for the use case of:

The same cert-manager installation is then used for dynamically provisioning mTLS Certificates for various internal microservices from an internal CA. Instances of the microservices may come and go, and so their Certificates are deleted as they are. But over time Secrets are then accumulating in Namespaces and require scripting / automating their cleanup to avoid etcd storage issues, affecting Secret watchers, etc. Enabling the CLI option for cert-manager could solve this, but then the Ingress Certificates would also be automatically cleaned up which is undesirable.

depending on the specifics.

Though, yet-another CSI driver on a cluster has a few extra downsides IMO:

1. Another DaemonSet means more processes and if you have to set resource requests / limits you might be eating memory / CPU reservation space on your machines (thought requests of 0 might be fine).
2. If you are a writing an operator that integrates with cert-manager, you added another component dependency on your operator users. Daemon components require extra scrutiny from enterprise platform and security teams, and might be a blocker for operator installation.

from cert-manager.