Currently certmonger removal from data plane is documented as a step very early in the adoption procedure. Step 8 here:

https://openstack-k8s-operators.github.io/data-plane-adoption/user/#migrating-tls-everywhere_storage-requirements

The issue with this is that it prevents control plane rollback – once we change the data plane, it is considered to be the point of no return.

From discussion with Grzegorz, this could be moved later in the procedure to the point of adopting data plane. It was placed in the TLS doc to have it together with the rest of the TLS steps (to avoid another "if TLS" section in another doc), but technically it can be done later.