chart: don't allow reading all secrets

[ibotty]

The clusterrolebinding cert-manager-webhook-hetzner:read-secrets is dangerous. It allows this webhook to read all secrets in the cluster. It only needs a rolebinding and could (maybe optionally) restrict the name of the secret.

Are you interested in a PR?

[lukasmetzner]

If you have multiple DNS zones from multiple Hetzner Cloud projects, you need multiple API tokens and therefore multiple secrets, probably in different namespaces. I know customers, which use such setups. Changing this now would be a breaking change for them.

We could possibly add an rbac.enabled value, which is true by default. This way people can easily disable the deployment of the clusterrole and clusterrolebinding and deploy there own.

[ibotty]

I know: I am running it with two different cloud accounts ATM. It could be behind a flag, or better yet, an array that when empty uses the broad configuration and if not specifies the secrets.

[lukasmetzner]

an array that when empty uses the broad configuration and if not specifies the secrets.

Sounds good to me. If you want, feel free to open a PR.

[TheRealBecks]

@ibotty Are you already working on this?