should match snapshot of default values:
  1: |
    apiVersion: apps/v1
    kind: Deployment
    metadata:
      labels:
        app.kubernetes.io/instance: RELEASE-NAME
        app.kubernetes.io/managed-by: Helm
        app.kubernetes.io/name: external-secrets-cert-controller
        app.kubernetes.io/version: v0.9.11
        helm.sh/chart: external-secrets-0.9.11
      name: RELEASE-NAME-external-secrets-cert-controller
      namespace: NAMESPACE
    spec:
      replicas: 1
      revisionHistoryLimit: 10
      selector:
        matchLabels:
          app.kubernetes.io/instance: RELEASE-NAME
          app.kubernetes.io/name: external-secrets-cert-controller
      template:
        metadata:
          labels:
            app.kubernetes.io/instance: RELEASE-NAME
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: external-secrets-cert-controller
            app.kubernetes.io/version: v0.9.11
            helm.sh/chart: external-secrets-0.9.11
        spec:
          automountServiceAccountToken: true
          containers:
            - args:
                - certcontroller
                - --crd-requeue-interval=5m
                - --service-name=RELEASE-NAME-external-secrets-webhook
                - --service-namespace=NAMESPACE
                - --secret-name=RELEASE-NAME-external-secrets-webhook
                - --secret-namespace=NAMESPACE
                - --metrics-addr=:8080
                - --healthz-addr=:8081
              image: ghcr.io/external-secrets/external-secrets:v0.9.11
              imagePullPolicy: IfNotPresent
              name: cert-controller
              ports:
                - containerPort: 8080
                  name: metrics
                  protocol: TCP
              readinessProbe:
                httpGet:
                  path: /readyz
                  port: 8081
                initialDelaySeconds: 20
                periodSeconds: 5
              securityContext:
                allowPrivilegeEscalation: false
                capabilities:
                  drop:
                    - ALL
                readOnlyRootFilesystem: true
                runAsNonRoot: true
                runAsUser: 1000
                seccompProfile:
                  type: RuntimeDefault
          hostNetwork: false
          serviceAccountName: external-secrets-cert-controller