Grant cert-manager RBAC to use all policies by default

[erikgb]

This PR should make it a bit easier to use approver-policy with cert-manager. By default, it will now grant RBAC permissions to use all CertificateRequestPolicies.

Close #216

/cc @hawksight @inteon @SgtCoDFish

[cert-manager-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign wallrj for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[inteon]

I think this might be something for a v2 of this component.
Also, I would rather just drop the RBAC logic.

[erikgb]

I think this might be something for a v2 of this component. Also, I would rather just drop the RBAC logic.

Could you elaborate? Especially on the last part. "RBAC logic"?

[inteon]

I think this might be something for a v2 of this component. Also, I would rather just drop the RBAC logic.

Could you elaborate? Especially on the last part. "RBAC logic"?

Instead of using RBAC to link CertificateRequests with CertificateRequestPolicies, we can use the .spec.selector instead.

[erikgb]

I think this might be something for a v2 of this component. Also, I would rather just drop the RBAC logic.

Could you elaborate? Especially on the last part. "RBAC logic"?

Instead of using RBAC to link CertificateRequests with CertificateRequestPolicies, we can use the .spec.selector instead.

But why did you create the referenced issue? The selector is already in use, but that connects the CertificateRequestPolicy to Issuers. Not to who created the CertificateRequest. AFAIK, RBAC isn't able to use selectors.

[erikgb]

@github-copilot review

[hawksight]

This certainly simplifies the existing setup process by wrapping it into the existing chart and on by default. On that basis I am in favour.

I don't think we should block an enhancement because we "might" do something better in the future.

The code look fine to me from a helm perspective but I have not tried it.

[hawksight]

/lgtm

[cert-manager-prow]

@hawksight: adding LGTM is restricted to approvers and reviewers in OWNERS files.

In response to this:

/lgtm

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.