Use renew trigger window instead of static renew time

[inteon]

Select random renewal time between 6/10 and 7/10 of certificate lifetime.

This reduces the load of all controllers generating their (leaf) certificate at the same time.
If CA rotation is not leader-election protected (eg. in #129), this also reduces contention on CA renewal.

[inteon]

/approve

[cert-manager-prow]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: inteon

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [inteon]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[Copilot]

Pull request overview

This PR replaces the static certificate renewal time (at 2/3 of certificate lifetime) with a randomized renewal window (between 6/10 and 7/10 of lifetime). This change helps distribute certificate renewal load across controllers and reduces contention during CA rotation.

Changes:

• Introduced TriggerWindow type with random time selection within a renewal window
• Updated CA and leaf certificate controllers to use randomized renewal scheduling
• Adjusted test cases to reflect the new 60% renewal threshold

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

File	Description
internal/certificate/renew.go	Replaced RenewAfter function with RenewTriggerWindow function that returns a time window (6/10 to 7/10 of lifetime) and added Random() method for selecting a random renewal time
pkg/authority/ca_secret_controller.go	Updated to use new randomized renewal window API for both scheduling requeues and checking if regeneration is required
pkg/authority/leaf_cert_controller.go	Updated to use new randomized renewal window API for scheduling requeues
pkg/authority/ca_secret_controller_test.go	Updated test cases to verify the new 60% renewal threshold instead of the old 66.67% threshold

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 4 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[erikgb]

/lgtm