Feature Request: Add annotation to disable automatic certificate renewal #8085

Feature Request

Problem Statement

Currently, cert-manager automatically renews certificates when they approach expiry based on the renewBefore or renewBeforePercentage settings. However, there are scenarios where users need to disable automatic renewal for specific certificates while keeping cert-manager managing the certificate lifecycle.

Use Cases:

1. Compliance Requirements: Some organizations have strict change control processes that require manual approval before certificate renewal
2. Testing Scenarios: During testing or staging environments, teams may want to test certificate expiry handling
3. Migration Periods: When migrating between certificate authorities or during infrastructure changes, temporary suspension of auto-renewal may be needed
4. Cost Control: For certificates from paid CAs, organizations may want manual control over renewal timing
5. Special Certificates: Certain certificates may have dependencies that require coordinated renewal with other systems

Proposed Solution

Add a new annotation cert-manager.io/disable-reissue that, when set to "true" on a Certificate resource, prevents automatic renewal even when the certificate approaches its expiry time.

Example Usage:

apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: example-cert
  namespace: default
  annotations:
    cert-manager.io/disable-reissue: "true"  # Disable automatic renewal
spec:
  secretName: example-cert-tls
  issuerRef:
    name: example-issuer
    kind: Issuer
  commonName: example.com
  dnsNames:
    - example.com

Implementation Details

1. Annotation Name: cert-manager.io/disable-reissue
2. Accepted Values:
   • "true" - Disables automatic renewal
   • "false" or absent - Default behavior (automatic renewal enabled)
3. Scope: Only affects automatic renewal triggered by approaching expiry. Manual renewal (e.g., through cmctl or by modifying the Certificate) should still work
4. Components to Modify:
   • certificates-trigger controller: Skip renewal trigger when annotation is present
   • certificates-readiness controller: Update status message to indicate reissue is disabled
   • Policy evaluation chain: Skip CurrentCertificateNearingExpiry check when annotation is set

Expected Behavior

When annotation is set to "true":

• Certificate will NOT be automatically renewed when approaching expiry
• Certificate Ready condition remains True until actual expiry
• Status should indicate that reissue is disabled (optional)
• Events/logs should note that renewal was skipped due to the annotation
• Manual renewal triggers should still function normally

When annotation is removed or set to "false":

• Normal reissue behavior resumes
• If certificate is already past its renewal time, renewal should be triggered immediately