With rotationPolicy: Never, a private key is only generated if one does notalready exist in the target Secret resource (using the tls.key key). Allfurther issuances will re-use this private key. This is the default in order tomaintain compatibility with previous releases.