In all of our current uses of os.umask or filesystem.umask, we always temporarily set it to a different value and then restore it using a try/finally block. I expect this pattern to continue.

Because of that, why don't we create a simple function in certbot.util that can be used as a context manager to set umask to a value and restore it to its previous value when exiting the with blo

Is your feature request related to a problem? Please describe.
@munnerz helped debug this today.

Someone set kubernetes.io/ingress.allow-http: "false" on an Ingress resource. When time came to refresh the cert it just hung forever with no errors or event or anything.

Describe the solution you'd like
I'd have liked to see an Event and/or Condition on the Ingress saying "cert-mana