apiVersion: v1
kind: ServiceAccount
metadata:
  name: cert-manager-config-deployer
  namespace: cert-manager
automountServiceAccountToken: false
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: cert-manager-config-deployer
rules:
  - apiGroups: [cert-manager.io]
    resources: [clusterissuers]
    resourceNames: [letsencrypt-dns, letsencrypt-http]
    verbs: [get, patch, update]
  - apiGroups: [cert-manager.io]
    resources: [certificates]
    resourceNames: [brunner-ninja, watschn-studio, brgkepler-com, gschissenes-equipment]
    verbs: [get, patch, update]
  - apiGroups: [apps]
    resources: [deployments]
    resourceNames: [cert-manager, cert-manager-cainjector, cert-manager-webhook]
    verbs: [get]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: cert-manager-config-deployer
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cert-manager-config-deployer
subjects:
  - kind: ServiceAccount
    name: cert-manager-config-deployer
    namespace: cert-manager
---
apiVersion: v1
kind: Secret
metadata:
  name: cert-manager-config-deployer-token
  namespace: cert-manager
  annotations:
    kubernetes.io/service-account.name: cert-manager-config-deployer
type: kubernetes.io/service-account-token