# RBAC granting the cert-manager-webhook-ovh service account read access to the
# OVH credentials secret.
#
# The cert-manager-webhook-ovh chart only auto-creates this secret-reader Role
# when using its built-in `issuers[]` mechanism. Since we manage the
# ClusterIssuer and the credentials secret manually, we declare the RBAC here.
#
# The webhook runs in the cert-manager namespace under the
# `cert-manager-webhook-ovh` service account (created by the Helm release).
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
    name: cert-manager-webhook-ovh:ovh-secret-reader
    namespace: cert-manager
    labels:
        app.kubernetes.io/name: cert-manager-webhook-ovh
        app.kubernetes.io/component: ovh-secret-reader
rules:
    - apiGroups: [""]
      resources: ["secrets"]
      verbs: ["get", "watch"]
      resourceNames:
          - ovh-credentials
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
    name: cert-manager-webhook-ovh:ovh-secret-reader
    namespace: cert-manager
    labels:
        app.kubernetes.io/name: cert-manager-webhook-ovh
        app.kubernetes.io/component: ovh-secret-reader
roleRef:
    apiGroup: rbac.authorization.k8s.io
    kind: Role
    name: cert-manager-webhook-ovh:ovh-secret-reader
subjects:
    - apiGroup: ""
      kind: ServiceAccount
      name: cert-manager-webhook-ovh
      namespace: cert-manager