openshift-devspaces sync fails with included networkpolicies

Using the aggregate/overlays/default overlay

Syncing the checluster returns:

Internal error occurred: failed calling webhook "mchecluster.kb.io": failed to call webhook: Post "https://devspaces-operator-service.openshift-devspaces.svc:443/mutate-org-eclipse-che-v2-checluster?timeout=10s": context deadline exceeded

I was able to work around this by adding this networkpolicy:

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-webhook-from-apiserver
spec:
  ingress:
    - ports:
      - protocol: TCP
        port: 9443
  podSelector: {}
  policyTypes:
  - Ingress

This appears to be necessary because the kube-apiserver uses host networking, but that should be verified.

Start with the aggregate/overlays/default overlay and reproduce the CheCluster sync failure shown in the report. Investigate whether the included NetworkPolicies allow the kube-apiserver to reach the webhook on port 9443; done means syncing succeeds without the manual allow-webhook-from-apiserver policy.