Requirement to have write access to kube-system namespace

[waza-ari]

Hi,

first of all, thanks for providing this amazing project! I'm installing it to a new cluster via ArgoCD, which essentially requires to specify which namespaces a certain project has access to. Typically, a project is constrained to the namespace(s) it requires. Nginx Ingress and cert-manager are there already, however your Helm chart installs one specific RoleBinding in the cube-system namespace:

cert-manager-webhook-hetzner/deploy/cert-manager-webhook-hetzner/templates/rbac.yaml

Line 19 in 91ef1e6

namespace: kube-system

There are some scenarios in GKE where the kube-system namespace is completely protected (see https://cert-manager.io/docs/installation/compatibility/ for example), and it seems like a good idea in general.

I'm wondering why this permission is required, could you provide any details? If its not strictly necessary, would it be possible to at least allow disabling it via helm chart values?