Simplify configuration by creating RBAC by default

[inteon]

Currently, it is quite complex to configure approver-policy due to all the necessary additional RBAC.

The following RBAC could be added to the Helm chart to simplify usage (easy-mode):

1. allow approver-policy to approve all issuer types:

- apiGroups: ["cert-manager.io"]
  resources: ["signers"]
  verbs: ["approve"]
...
- kind: ServiceAccount
  name: {{ include "cert-manager-approver-policy.name" . }}
  namespace: {{ .Release.Namespace }}

2. make all policies applicable to the cert-manager SA by default (use selector for filtering instead):

- apiGroups: ["policy.cert-manager.io"]
  resources: ["certificaterequestpolicies"]
  verbs: ["use"]
...
- kind: ServiceAccount
  name: cert-manager
  namespace: {{ .Release.Namespace }}

cc @wallrj @JoshVanL

[erikgb]

It seems like 1. was fixed by #416, but as far as I can see 2. still remains unresolved.

/help

[cert-manager-prow]

@erikgb:
This request has been marked as needing help from a contributor.

Please ensure the request meets the requirements listed here.

If this request no longer meets these requirements, the label can be removed
by commenting with the /remove-help command.

Details

In response to this:

It seems like 1. was fixed by #416, but as far as I can see 2. still remains unresolved.

/help

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.