In all of our current uses of os.umask or filesystem.umask, we always temporarily set it to a different value and then restore it using a try/finally block. I expect this pattern to continue.

Because of that, why don't we create a simple function in certbot.util that can be used as a context manager to set umask to a value and restore it to its previous value when exiting the with blo

Is your feature request related to a problem? Please describe.
At cert-manager 1.0, there is ServiceMonitor to scrape certs metrics, but there is no alert(s) on certs renew failures to cluster operator.

Describe the solution you'd like
PrometheusRule object with alerting rules about expiring certs. Plus, ability to extend/override default rules via helm values.

/kind feature