And attach sa to hr.

kubernetes/apps/cert-manager/webhook-dnsimple/app/helmrelease.yaml

@@ -56,4 +56,7 @@ spec:
         name: webhook-dnsimple-webhook-tls
         globalMounts:
           - path: /tls
-            readOnly: true
+            readOnly: true
+    serviceAccount:
+      create: true
+      name: webhook-dnsimple

kubernetes/apps/cert-manager/webhook-dnsimple/app/rbac.yaml

@@ -1,12 +1,4 @@
 ---
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: webhook-dnsimple
-  namespace: "cert-manager"
-  labels:
-    app: cert-manager-webhook-dnsimple
----
 # Grant cert-manager permission to validate using our apiserver
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole