Migrate cert-manager to externally controlled file + patches

k8s/operators/cert-manager/controller-patches.yaml

@@ -0,0 +1,3 @@
+- op: add
+  path: /spec/template/spec/containers/0/args/-
+  value: --dns01-recursive-nameservers-only # adding this arg makes DNS-01 validation work, unclear why it doesnt work otherwise.

k8s/operators/cert-manager/kustomization.yaml

@@ -2,9 +2,13 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 # namespace: cert-manager
 resources:
-  - cert-manager.yaml # source: https://github.com/cert-manager/cert-manager/releases/download/v1.15.0/cert-manager.yaml
+  - https://github.com/cert-manager/cert-manager/releases/download/v1.15.1/cert-manager.yaml
   - secrets.yaml
   - pdns-hook.yaml
   - letsencrypt.yaml
   - selfsigned.yaml
-
+patches:
+  - path: controller-patches.yaml
+    target:
+      kind: Deployment
+      name: cert-manager