cert-manager: 1.18.6 -> 1.19.6
Change-Id: I03ccd9378c24a6160b9949e90bfa467595a82b22
diff --git a/charts/cert-manager/templates/rbac.yaml b/charts/cert-manager/templates/rbac.yaml
index baae425..076fd05 100644
--- a/charts/cert-manager/templates/rbac.yaml
+++ b/charts/cert-manager/templates/rbac.yaml
@@ -49,7 +49,7 @@
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
- name: {{ template "cert-manager.serviceAccountName" . }}-tokenrequest
+ name: {{ template "cert-manager.fullname" . }}-tokenrequest
namespace: {{ include "cert-manager.namespace" . }}
labels:
app: {{ include "cert-manager.name" . }}
@@ -69,7 +69,7 @@
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
- name: {{ include "cert-manager.fullname" . }}-{{ template "cert-manager.serviceAccountName" . }}-tokenrequest
+ name: {{ include "cert-manager.fullname" . }}-tokenrequest
namespace: {{ include "cert-manager.namespace" . }}
labels:
app: {{ include "cert-manager.name" . }}
@@ -80,7 +80,7 @@
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
- name: {{ template "cert-manager.serviceAccountName" . }}-tokenrequest
+ name: {{ template "cert-manager.fullname" . }}-tokenrequest
subjects:
- kind: ServiceAccount
name: {{ template "cert-manager.serviceAccountName" . }}
@@ -256,8 +256,8 @@
- apiGroups: ["networking.k8s.io"]
resources: ["ingresses"]
verbs: ["get", "list", "watch", "create", "delete", "update"]
- - apiGroups: [ "gateway.networking.k8s.io" ]
- resources: [ "httproutes" ]
+ - apiGroups: ["gateway.networking.k8s.io"]
+ resources: ["httproutes"]
verbs: ["get", "list", "watch", "create", "delete", "update"]
# We require the ability to specify a custom hostname when we are creating
# new ingress resources.
@@ -511,9 +511,23 @@
- apiGroups: ["cert-manager.io"]
resources: ["certificates/status"]
verbs: ["update"]
+ {{- /*
+ Challenge and Order resources are not intended to be created or
+ modified directly by users.
+
+ Challenges: "create" is excluded. "patch" and "update" are retained
+ because spec is immutable after creation (ValidateChallengeUpdate)
+ and because users need them to remove stuck finalizers
+ (see cert-manager/cert-manager#3851, cert-manager/cert-manager#3870).
+
+ Orders: "create", "patch", and "update" are excluded.
+ */}}
- apiGroups: ["acme.cert-manager.io"]
- resources: ["challenges", "orders"]
- verbs: ["create", "delete", "deletecollection", "patch", "update"]
+ resources: ["challenges"]
+ verbs: ["delete", "deletecollection", "patch", "update"]
+ - apiGroups: ["acme.cert-manager.io"]
+ resources: ["orders"]
+ verbs: ["delete", "deletecollection"]
---