a helm chart is creating a random certificate on install, which pulumi naturally diffs on every execution and correctly identifies as having changed