Every time cert-manager renews a certificate it creates a new CertificateRequest resource for that renewal and, in cert-manager versions older than 1.18.0, old CertificateRequest resources are never cleaned up. Version 1.18.0 and later keeps only the latest request by default, but in order to make older cert-manager delete old requests after a renewal it is necessary to specify an explicit revisionHistoryLimit on the Certificate resource.
We should set this on our certificates explicitly so they behave the same in all supported cert-manager versions.