I was following this and, thanks to Ilya Shaisultanov, just realised that you can put the namespace in the tls.secretName so you don’t actually need the kubernetes-replicator at all. Simply create the cert somewhere and reference it with <namespace>/<secret>.

Hope this helps someone.