cert-manager: upgrade from 1.12.17 to 1.17.4
Change-Id: Iea0d6eac22a57f9f1fc522e6abdd9359fbbd1415
diff --git a/charts/cert-manager/templates/webhook-rbac.yaml b/charts/cert-manager/templates/webhook-rbac.yaml
index b075ffd..b99325e 100644
--- a/charts/cert-manager/templates/webhook-rbac.yaml
+++ b/charts/cert-manager/templates/webhook-rbac.yaml
@@ -15,6 +15,15 @@
resources: ["secrets"]
resourceNames:
- '{{ template "webhook.fullname" . }}-ca'
+ {{- $certmanagerNamespace := include "cert-manager.namespace" . }}
+ {{- with (.Values.webhook.config.metricsTLSConfig).dynamic }}
+ {{- if $certmanagerNamespace | eq .secretNamespace }}
+ # Allow webhook to read and update the metrics CA Secret when dynamic TLS is
+ # enabled for the metrics server and if the Secret is configured to be in the
+ # same namespace as cert-manager.
+ - {{ .secretName | quote }}
+ {{- end }}
+ {{- end }}
verbs: ["get", "list", "watch", "update"]
# It's not possible to grant CREATE permission on a single resourceName.
- apiGroups: [""]
@@ -38,8 +47,7 @@
kind: Role
name: {{ template "webhook.fullname" . }}:dynamic-serving
subjects:
-- apiGroup: ""
- kind: ServiceAccount
+- kind: ServiceAccount
name: {{ template "webhook.serviceAccountName" . }}
namespace: {{ include "cert-manager.namespace" . }}
@@ -76,8 +84,7 @@
kind: ClusterRole
name: {{ template "webhook.fullname" . }}:subjectaccessreviews
subjects:
-- apiGroup: ""
- kind: ServiceAccount
+- kind: ServiceAccount
name: {{ template "webhook.serviceAccountName" . }}
namespace: {{ include "cert-manager.namespace" . }}
{{- end }}