<p>I want to use <a href="https://github.com/baarde/cert-manager-webhook-ovh" rel="nofollow noreferrer">cert-manager OVH's webhook</a> in order to deliver a https wildcard certificate, but I still can't figure out why the cert-manager can't access to OVH credentials secret (required to create a DNS entry in OVH)</p>
<p>The <code>ovh-credentials</code> secret has been created on the <code>default</code> namespace</p>
<p>The cert-manager is on a <code>cert-manager</code> namespace and the <code>cert-manager-webhook-ovh</code> is on the <code>default</code> namespace</p>
<p>I have a <code>ClusterIssuer</code> which is calling the <code>cert-manager-webhook-ovh</code></p>
<p>I have defined a <code>cert-manager-webhook-ovh:secret-reader</code> <code>ClusterRole</code></p>
<p>And a <code>ClusterRole</code> binding between <code>cert-manager-webhook-ovh</code> service account and</p>
<p>the <code>cert-manager-webhook-ovh:secret-reader</code> <code>ClusterRole</code></p>
<pre><code>apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: cert-manager-webhook-ovh:secret-reader
rules:
- apiGroups: [&quot;&quot;]
  resources: [&quot;secrets&quot;]
  resourceNames: [&quot;ovh-credentials&quot;]
  verbs: [&quot;get&quot;, &quot;watch&quot;]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: cert-manager-webhook-ovh:secret-reader
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cert-manager-webhook-ovh:secret-reader
subjects:
- apiGroup: &quot;&quot;
  kind: ServiceAccount
  name: cert-manager-webhook-ovh
  namespace: cert-manager
</code></pre>
<p>here are my pods</p>
<pre><code>➜  alaya-studio git:(main) ✗ kubectl get pods --namespace=cert-manager
NAME                                       READY   STATUS    RESTARTS   AGE
cert-manager-6588898cb4-nfn7p              1/1     Running   1          27d
cert-manager-cainjector-7bcbdbd99f-tgllj   1/1     Running   5          27d
cert-manager-webhook-5fd9f9dd86-csjzq      1/1     Running   0          27d
➜  alaya-studio git:(main) ✗ kubectl get pods
NAME                                                  READY   STATUS    RESTARTS   AGE
cert-manager-webhook-ovh-77f9c7cc7b-xfdfx             1/1     Running   4          15d
express-59df84c766-8wjxw                              1/1     Running   0          27d
express-59df84c766-l4cf8                              1/1     Running   0          27d
express-59df84c766-w6hbt                              1/1     Running   0          27d
ngingress-ingress-nginx-controller-5586599f89-5fsgn   1/1     Running   0          28d
</code></pre>
<p>When creating the challenge I have this error</p>
<pre><code>  Type     Reason        Age              From          Message
  ----     ------        ----             ----          -------
  Normal   Started       9s               cert-manager  Challenge scheduled for processing
  Warning  PresentError  5s (x3 over 7s)  cert-manager  Error presenting challenge: secrets &quot;ovh-credentials&quot; is forbidden: User &quot;system:serviceaccount:default:cert-manager-webhook-ovh&quot; cannot get resource &quot;secrets&quot; in API group &quot;&quot; in the namespace &quot;cert-manager&quot;
</code></pre>

<p>The error message indicating to ServiceAccount <code>cert-manager-webhook-ovh</code> of <code>default</code> namespace. You have given permission to the the ServiceAccount of <code>cert-manager</code> namespace.</p>
<pre><code>secrets &quot;ovh-credentials&quot; is forbidden: User &quot;system:serviceaccount:default:cert-manager-webhook-ovh&quot; cannot get resource &quot;secrets&quot; in API group &quot;&quot; in the namespace &quot;cert-manager&quot;
</code></pre>
