I'm actually not on AWS, just used EKS extensively at my last job (and we still manually test our software against it). AWS burned me hard with forgetting to a

I'm actually not on AWS, just used EKS extensively at my last job (and we still manually test our software against it). AWS burned me hard with forgetting to auto-renew certs at my last job. It just stopped working, the deadline passed, and only a support ticket and manual hacking on their side could make it work. cert-manager has been significantly more reliable and at least transparent. The mistake we make right now is asking for certificates on demand in the critical path of running our app -- but since we control the domain name, we could easily have a pool of domain names and certificates ready to go. Our mistake is having not done that yet.