Instead of generating a certificate on upgrade (which breaks GitOps tools such as ArgoCD which detect drift), allow the user to create a cert-manager certificate using a values flag.
This could be done in a similar way to what is written here: https://github.com/wiz-sec/charts/blob/master/wiz-admission-controller/templates/certmanager.yaml