From 0b007c3d62e269dfbdfc38c400528df4f85e67de Mon Sep 17 00:00:00 2001
From: willemjan <wulsspaans@gmail.com>
Date: Tue, 13 Oct 2026 08:52:23 +0200
Subject: [PATCH] add webhook rbac

---
 infrastructure/cert-manager/webhook-rbac.yaml | 25 +++++++++++++++++++
 1 file changed, 25 insertions(+)
 create mode 100644 infrastructure/cert-manager/webhook-rbac.yaml

diff --git a/infrastructure/cert-manager/webhook-rbac.yaml b/infrastructure/cert-manager/webhook-rbac.yaml
new file mode 100644
index 0000000..6ffff1f
--- /dev/null
+++ b/infrastructure/cert-manager/webhook-rbac.yaml
@@ -0,0 +1,25 @@
+# infrastructure/cert-manager/webhook-rbac.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: cert-manager-webhook-duckdns-token-reader
+  namespace: cert-manager
+rules:
+- apiGroups: [""]
+  resources: ["secrets"]
+  resourceNames: ["duckdns-token"]
+  verbs: ["get"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: cert-manager-webhook-duckdns-token-reader
+  namespace: cert-manager
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: cert-manager-webhook-duckdns-token-reader
+subjects:
+- kind: ServiceAccount
+  name: cert-manager-webhook-duckdns
+  namespace: cert-manager
\ No newline at end of file