Simplify configuration by creating RBAC by default #216
Description
Currently, it is quite complex to configure approver-policy due to all the necessary additional RBAC.
The following RBAC could be added to the Helm chart to simplify usage (easy-mode):
- allow approver-policy to approve all issuer types:
- apiGroups: ["cert-manager.io"]
resources: ["signers"]
verbs: ["approve"]
...
- kind: ServiceAccount
name: {{ include "cert-manager-approver-policy.name" . }}
namespace: {{ .Release.Namespace }}- make all policies applicable to the cert-manager SA by default (use selector for filtering instead):
- apiGroups: ["policy.cert-manager.io"]
resources: ["certificaterequestpolicies"]
verbs: ["use"]
...
- kind: ServiceAccount
name: cert-manager
namespace: {{ .Release.Namespace }}