fix: tryfix secret read permissions

kubernetes/system/cert-manager-issuer/ovh-secret-reader-rbac.yaml

@@ -0,0 +1,41 @@
+# RBAC granting the cert-manager-webhook-ovh service account read access to the
+# OVH credentials secret.
+#
+# The cert-manager-webhook-ovh chart only auto-creates this secret-reader Role
+# when using its built-in `issuers[]` mechanism. Since we manage the
+# ClusterIssuer and the credentials secret manually, we declare the RBAC here.
+#
+# The webhook runs in the cert-manager namespace under the
+# `cert-manager-webhook-ovh` service account (created by the Helm release).
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+    name: cert-manager-webhook-ovh:ovh-secret-reader
+    namespace: cert-manager
+    labels:
+        app.kubernetes.io/name: cert-manager-webhook-ovh
+        app.kubernetes.io/component: ovh-secret-reader
+rules:
+    - apiGroups: [""]
+      resources: ["secrets"]
+      verbs: ["get", "watch"]
+      resourceNames:
+          - ovh-credentials
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+    name: cert-manager-webhook-ovh:ovh-secret-reader
+    namespace: cert-manager
+    labels:
+        app.kubernetes.io/name: cert-manager-webhook-ovh
+        app.kubernetes.io/component: ovh-secret-reader
+roleRef:
+    apiGroup: rbac.authorization.k8s.io
+    kind: Role
+    name: cert-manager-webhook-ovh:ovh-secret-reader
+subjects:
+    - apiGroup: ""
+      kind: ServiceAccount
+      name: cert-manager-webhook-ovh
+      namespace: cert-manager