Convert. cmctl convert can be used to convert cert-manager manifest files between different API versions. Both YAML and JSON formats are accepted. The command either takes a file name, directory path, or a URL as input. The contents is converted into the format of the latest API version known to cert-manager, or the one specified by --output-version flag.
The implication for a kubectl apply type installation is then either "you must manually update the manifests prior to installation by replacing kube-system with cert-manager" or "Don't install cert-manager using kubectl apply. Helm is the recommended solution". AWS EKS. When using a custom CNI (such as Weave or Calico) on EKS, the webhook cannot be reached by cert-manager.
This looks to be caused by a patch done in Version 3.3.2 of Helm for security based issues.
Reference Issue: https://github.com/helm/helm/issues/8761
Security Patch: https://github.com/helm/helm/pull/8762