Embedding cert-manager into CAPI for smaller footprint/less upgrade deps

I recently realized that the 3 cert-manager related processes we use in CAPI are actually not required when a cluster is running, and only required, i believe:

• on upgrades
• on creation of a new cluster

User Story

As a CAPI User I'd like to minimize the number of containers I need to run persistently in my cluster, and thus i'd like a like a default "batteries included" certificate management solution running in one my essential capi pods... so that i dont need to run certmanager after cluster creation.

i.e. the dumbed down version of this would be something like... "lets just vendor certmanager and use it when needed".

Detailed Description

I think these 3 services:

• ca-injector
• webhook
• certmanager

Can

• all be run as one off processes on startup
• invoked as needed during upgrades
• be non-existent at other times ?

Anything else you would like to add:

/kind feature