Describe the bug:

I have an ingress for which I am provisioning certificates, with these annotations:

    annotations:
      cert-manager.io/cluster-issuer: staging
      cert-manager.io/private-key-algorithm: ECDSA

The problem is that my certificate ends up with these labels applied to it, which seem to be copied from the ingress resource:

    labels:
      app: keycloak
      applyset.kubernetes.io/part-of: applyset-hKKbb7RbYuU0FpW0aj6J1V02xlxKvG_l7wjuo6REa0U-v1

These copied labels are causing problems because kubectl --prune wants to delete my certificate due to the applyset.kubernetes.io/part-of label. This behaviour doesn't seem to be documented anywhere, and from a Slack discussion seems to be a bug.

Expected behaviour:

I expect the certificate to be created without any labels. If this is not possible for backwards-compatibility reasons, I would like to be able to deny-list certain labels (specifically applyset.kubernetes.io/part-of in my case).

Steps to reproduce the bug:

1. Install cert-manager with the default static manifests
2. Create the following ingress resource:

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: keycloak
  namespace: keycloak
  labels:
    app: keycloak
  annotations:
    cert-manager.io/cluster-issuer: staging
    cert-manager.io/private-key-algorithm: ECDSA
spec:
  ingressClassName: external
  tls:
    - hosts: ["example.com"]
      secretName: keycloak-tls
  rules:
    - http:
       host: "example.com" 
       paths:
        - path: /
          pathType: Prefix
          backend: { service: { name: keycloak, port: { name: http } } }

3. Observe that the created Certificate has the same labels as the ingress.

Anything else we need to know?:

From the Slack thread:

• Code here:

  cert-manager/pkg/controller/certificate-shim/sync.go

  Line 378 in d2f6bbe

  Labels: ingLike.GetLabels(),

• PR introducing this behaviour: https://github.com/cert-manager/cert-manager/pull/1450/files#diff-76233e2bc68eec8223c36383b6d5c0672e1ca809e3e7e280e6f3716fabdd6bb6R160

Environment details::

• Kubernetes version: 1.28.2
• cert-manager version: 1.13.2
• Install method: static manifests

/kind bug