I use cert-manager for internal mTLS and am satisfied with it. I found it surprisingly easy to use compared to things that try to be automatic, like linkerd and istio. (Plus, I can verify the authenticity of the connection at the application layer, and make appropriate decisions rather than having to trust "oh yeah, the sidecar has it under control, nothing to see here".)
It's a downgrade in security compared to pressing a physical button a YubiKey every so often... but I am OK with things being automatically renewed. (It basically means, if you own the apiserver, you own the network, which is a tradeoff I can live with. Compare this to "if you can intercept any packet, you own the network", which is what non-mTLS is.)