ServiceAccount missing permissions to list ClusterOriginIssuer resources

[xorinzor]

After updating to 0.9.0 and creating a ClusterOriginIssuer my pod is throwing this error:

W0709 20:16:22.501014       1 reflector.go:539] pkg/mod/k8s.io/client-go@v0.29.0/tools/cache/reflector.go:229: failed to list *v1.ClusterOriginIssuer: clusteroriginissuers.cert-manager.k8s.cloudflare.com is forbidden: User "system:serviceaccount:cloudflare-origin-ca-issuer:cloudflare-origin-ca-issuer" cannot list resource "clusteroriginissuers" in API group "cert-manager.k8s.cloudflare.com" at the cluster scope
E0709 20:16:22.501074       1 reflector.go:147] pkg/mod/k8s.io/client-go@v0.29.0/tools/cache/reflector.go:229: Failed to watch *v1.ClusterOriginIssuer: failed to list *v1.ClusterOriginIssuer: clusteroriginissuers.cert-manager.k8s.cloudflare.com is forbidden: User "system:serviceaccount:cloudflare-origin-ca-issuer:cloudflare-origin-ca-issuer" cannot list resource "clusteroriginissuers" in API group "cert-manager.k8s.cloudflare.com" at the cluster scope

Deleting the ServiceAccount and letting Helm recreate it doesn't fix the problem.

Relates to #125

[terinjokes]

The non-Helm RBAC files got updated, but they got missed for Helm. We don't use Helm, so easy for us to miss.

[xorinzor]

No worries, I appreciate the quick response & fix; Thanks!