This is more of a cilium issue than a cert-manager one, but I'm posting it here so others may find it.

When enforcing network policies with Cilium, the allow-egress policy that's created trhough helm if webhook.networkPolicy.enabled=true doesn't work. While that policy should allow pretty much all egress (including TCP/(6)443), to ipBlock 0.0.0.0/0, this doesn't work on Cilium when your kube-apiserver is hosted on cluster nodes, unless you configure this: https://docs.cilium.io/en/stable/security/policy/language/#selecting-nodes-with-cidr-ipblock. See also cilium/cilium#20550.

Cert-manager could also help here by:

• Documenting this somewhere, e.g. in the Helm values documentation.
• Offering a way to only enable the ingress NetworkPolicy.

(Based on cilium v1.18.4 and cert-manager v1.18.2)