When deploying cert-manager using the Helm chart, we can specify the serviceAccount to use for:

• the Webohook
• the CA injector
• the deployment

But we can't specify it for the HTTP01 ACME solver pod.

The problems with this are:

• If the default serviceAccount is disabled, we need to provide a custom one
• We can't use a serviceAccount with linked imagePullSecrets to be able to pull the solver image from private registries in air gapped environments
• We can't apply PSPs to the solver pod.

To solve this, we propose to add a parameter --acme-http01-solver-service-account to cert-manager deployment to specify the serviceAccount to use in every namespace.

/kind feature