The default kubespray addon for cert manager ( v1.15.3) latest is (v1.19.1) is outdated and it seems some of the override functions dont apply when specifying in in inventory as override.
example,
cert_manager_dns_config:
nameservers:
- "<custom DNS ip>"
We can disable it from the
Cert manager deployment
cert_manager_enabled: true
Would rather pull from upstream jetstack chart and combine it with the infra deploy scripts
Link: https://cert-manager.io/docs/installation/helm/
also in include in options to use envoy.