helm: cert-manager issuer group hardcoded to cert-manager.io breaks external issuers (e.g. aws-privateca-issuer)

[maintux-nn]

Problem

The certificate.yaml Helm template hardcodes group: cert-manager.io
when generating the cert-manager Certificate resource, even when
tls.certManager.existingIssuer.enabled=true.

This breaks setups that use external cert-manager issuer plugins whose
group differs from the standard one. For example, the
aws-privateca-issuer plugin uses the group awspca.cert-manager.io,
and providing an existingIssuer with kind: AWSPCAIssuer without the
correct group causes cert-manager to fail resolving the issuer.

Expected behavior

When tls.certManager.existingIssuer.enabled=true, the group field of
the issuer reference should be configurable by the user.

Fix

Add a tls.certManager.existingIssuer.group value (defaulting to
cert-manager.io for backward compatibility) and use it in the template.

A PR is open for this: #1797

[k8s-ci-robot]

This issue is currently awaiting triage.

If metrics-server contributors determine this is a relevant issue, they will accept it by applying the triage/accepted label and provide further guidance.

The triage/accepted label can be added by org members by writing /triage accepted in a comment.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[rexagod]

/assign @yangjunmyfm192085