The patch add the annotation `checksum/secret-<name of the TLS secret>` with the sha512 value of the secret. This ensures a rolling update if the TLS secrets has been updated. Such an update can be triggered by the cert-manager.