I would expect when using cert-manager that setting tls.certs.certManager is enough. However, the copy-certs init container is not created since tls.certs.provided has to be true as well. Is this intended? If yes, the documentation should explicitly state that.