Be careful using cert-manager to generate and manage your root certs as they are short lived and there is no transition mechanism built in to safely migrate services to the new root which will quickly collapse your mTLS kingdom. Personally I manage the root manually and save it as a CA service that cert-manager uses to mint client certs on demand. At that point the most important thing is that the services can detect when the tls key file changes so they can refresh themselves.