charts: tailscale give secret patch role
diff --git a/charts/tailscale/templates/install.yaml b/charts/tailscale/templates/install.yaml
index 6227c7e..78b3704 100644
--- a/charts/tailscale/templates/install.yaml
+++ b/charts/tailscale/templates/install.yaml
@@ -70,3 +70,27 @@
# volumeMounts:
# - name: tailscale
# mountPath: /tailscale-state
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+ name: secrets
+ namespace: {{ .Release.Namespace }}
+rules:
+- apiGroups: [""]
+ resources: ["secrets"]
+ verbs: ["get", "watch", "list", "patch"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+ name: secrets
+ namespace: {{ .Release.Namespace }}
+subjects:
+- kind: ServiceAccount
+ name: default
+ namespace: {{ .Release.Namespace }}
+roleRef:
+ kind: Role
+ name: secrets
+ apiGroup: rbac.authorization.k8s.io