As documentation, the prerequisites/installation steps for multus does not mention cert-manager as prerequisites. While for other packages like, harbor/promethues/grafana/fluent-bit, cert-manager is prereq and is mentioned under the installation steps of these individual components. However, for External DNS and Multus, cert manager is not shown as prereq or under installation step as required. As per question, ask is to isolate application and mgmt traffic and usually application is exposed using contour as ingress. Hence possibly, answer should be multus and contour