[Hrishikesh Kashyap (Hrishikeshkashyap)]

Summary

• Split the certificate Role into namespace-wide Secret reads and name-restricted writes.
• Allow patch and update only on {{ .Values.name }}-webhook-cert, matching the manager's configured certificate Secret.
• Retain namespace-wide get/list/watch for compatibility with the existing cert-controller informer.

Validation

• Live AKS validation in an isolated temporary namespace: actual certificate Secret patch/update succeeded; actual unrelated Secret patch/update returned Forbidden. Authorization checks confirmed namespace-wide reads remain allowed and create/delete remain denied.

Scope

This reduces modification authority only. Namespace-wide Secret-content read exposure remains unresolved. Filtering informer requests upstream (open-policy-agent/cert-controller#590) is separate enabling work for a future read-RBAC restriction and is not required for this change.

[Copilot]

🟢 Approval recommended

The narrowly scoped permission change preserves required certificate access, with reported live validation and no unresolved findings.

No open issues 🎉

What changed in this PR

This PR narrows the Helm chart’s certificate Secret write permissions while preserving the reads needed by the certificate controller.

Changes:

• Separates namespace-wide get/list/watch permissions from Secret write permissions.
• Restricts patch/update to {{ .Values.name }}-webhook-cert.
• Leaves namespace-wide Secret read exposure unchanged and explicitly out of scope.

File	Description
charts/​latest/​templates/​certificate-rbac.yaml	Splits Secret read and write rules, restricting writes to the configured certificate Secret.

_{Review effort: Balanced}