should match snapshot of default values:
  1: |
    apiVersion: apps/v1
    kind: Deployment
    metadata:
      labels:
        app.kubernetes.io/instance: RELEASE-NAME
        app.kubernetes.io/managed-by: Helm
        app.kubernetes.io/name: external-secrets-cert-controller
        app.kubernetes.io/version: v2.3.0
        helm.sh/chart: external-secrets-2.3.0
      name: RELEASE-NAME-external-secrets-cert-controller
      namespace: NAMESPACE
    spec:
      replicas: 1
      revisionHistoryLimit: 10
      selector:
        matchLabels:
          app.kubernetes.io/instance: RELEASE-NAME
          app.kubernetes.io/name: external-secrets-cert-controller
      template:
        metadata:
          labels:
            app.kubernetes.io/instance: RELEASE-NAME
            app.kubernetes.io/managed-by: Helm
            app.kubernetes.io/name: external-secrets-cert-controller
            app.kubernetes.io/version: v2.3.0
            helm.sh/chart: external-secrets-2.3.0
        spec:
          automountServiceAccountToken: true
          containers:
            - args:
                - certcontroller
                - --crd-requeue-interval=5m
                - --service-name=RELEASE-NAME-external-secrets-webhook
                - --service-namespace=NAMESPACE
                - --secret-name=RELEASE-NAME-external-secrets-webhook
                - --secret-namespace=NAMESPACE
                - --metrics-addr=:8080
                - --healthz-addr=:8081
                - --loglevel=info
                - --zap-time-encoding=epoch
                - --enable-partial-cache=true
              image: ghcr.io/external-secrets/external-secrets:v2.3.0
              imagePullPolicy: IfNotPresent
              name: cert-controller
              ports:
                - containerPort: 8080
                  name: metrics
                  protocol: TCP
                - containerPort: 8081
                  protocol: TCP
                  name: ready
              readinessProbe:
                httpGet:
                  path: /readyz
                  port: ready
                initialDelaySeconds: 20
                periodSeconds: 5
              securityContext:
                allowPrivilegeEscalation: false
                capabilities:
                  drop:
                    - ALL
                readOnlyRootFilesystem: true
                runAsNonRoot: true
                runAsUser: 1000
                seccompProfile:
                  type: RuntimeDefault
          hostNetwork: false
          serviceAccountName: external-secrets-cert-controller