Unnecesary empty apiGroup on HelmChart

[jorgemoralespou]

Describe the bug:
There's 3 resources in the Helm chart that have an empty apiGroup defined that is not needed and removed when applied to the cluster.

• https://github.com/cert-manager/cert-manager/blob/master/deploy/charts/cert-manager/templates/webhook-rbac.yaml#L79
• https://github.com/cert-manager/cert-manager/blob/master/deploy/charts/cert-manager/templates/rbac.yaml#L42
• https://github.com/cert-manager/cert-manager/blob/master/deploy/charts/cert-manager/templates/webhook-rbac.yaml#L41

All other references to subjects.ServiceAccount in any RoleBinding or ClusterRoleBinding are ok and don't have this empty apiGroup.

Expected behaviour:
It'll be better if these were not provided.

Environment details::

• Kubernetes version: 1.29
• cert-manager version: v1.14.4

/kind bug

[inteon]

/kind feature

[hawksight]

@jorgemoralespou does the existence of this apiGroup key cause a "diff" when applying these resources through a GitOps tool?

Or is it simply just cleaner to remove the redundant lines?

[jorgemoralespou]

It does, since Kubernetes (at least version 1.29) does remove these fields on the server side, and hence there's always diff when applying this in a GitOps way