Set appropriate RBAC flag for cluster applications

app/models/clusters/applications/cert_manager.rb

@@ -40,8 +40,7 @@ module Clusters
 
         def install_command_flags
           ['--set', 'ingressShim.defaultIssuerName=letsencrypt-prod'] +
-            ['--set', 'ingressShim.defaultIssuerKind=ClusterIssuer'] +
-            ['--set', 'rbac.create=false']
+            ['--set', 'ingressShim.defaultIssuerKind=ClusterIssuer']
         end
 
         private

lib/gitlab/kubernetes/helm/install_command.rb

@@ -69,18 +69,18 @@ module Gitlab
           name_flag +
             optional_tls_flags +
             optional_version_flag +
-            optional_rbac_create_flag +
+            rbac_create_flag +
             namespace_flag +
             value_flag +
             application_flags
         end
 
-        def optional_rbac_create_flag
-          return [] unless rbac?
-
-          # jupyterhub helm chart is using rbac.enabled
-          #   https://github.com/jupyterhub/zero-to-jupyterhub-k8s/tree/master/jupyterhub
-          %w[--set rbac.create=true,rbac.enabled=true]
+        def rbac_create_flag
+          if rbac?
+            %w[--set rbac.create=true,rbac.enabled=true]
+          else
+            %w[--set rbac.create=false,rbac.enabled=false]
+          end
         end
 
         def optional_version_flag