It looks like if the server is his by its IP, rather than it's hostname, the lets encrypt library will keep checking with smcache to see if there is a key stored in SecretManager. This is a good watch to chalk up lots of API calls on GCP. Need to figure out if this is an SMCache issue, or LetsEncrypt.
2022/01/30 07:28:20 smcache: Get called for: [xx_xxx_xxx_xxx]"
2022/01/30 07:28:20 smcache: GET svKey: projects/project-name-123456/secrets/xivup-xx_xxx_xxx_xxx/versions/latest"