I deploy cert-manager with its CRDs using the helm chart.
When upgrading to 1.19.0, cert-manager rotated all existing Certificates.

What happened

10:22:43 :

Fields on existing CertificateRequest resource not up to date: [spec.issuerRef]  from cert-manager

10:23:34: from the k8s API server:

 cognite-internal-ca-4 certificateRequest is created

This seems related to that change on the CRDs:
https://github.com/cert-manager/cert-manager/pull/7414/files?w=1#diff-001624fd2992dca5a14f93c39266ee79360a1231af2df533137c070a4490e869R130

The surprising part is that this change in the existing CertificateRequest triggered it. Even though the Certificate itself was correctly issued long ago

Environments

Multiple k8s clusters on GKE, AKS and EKS. Around v1.33.