diff --git a/stable/kube-lego/Chart.yaml b/stable/kube-lego/Chart.yaml
index bc33c8ceaa..971a881590 100644
--- a/stable/kube-lego/Chart.yaml
+++ b/stable/kube-lego/Chart.yaml
@@ -1,7 +1,7 @@
 apiVersion: v1
 description: Automatically requests certificates from Let's Encrypt
 name: kube-lego
-version: 0.1.10
+version: 0.1.11
 keywords:
   - kube-lego
   - letsencrypt
diff --git a/stable/kube-lego/README.md b/stable/kube-lego/README.md
index bc230748fd..4cff882ab6 100644
--- a/stable/kube-lego/README.md
+++ b/stable/kube-lego/README.md
@@ -53,6 +53,8 @@ Parameter | Description | Default
 `podAnnotations` | annotations to be added to pods | `{}`
 `replicaCount` | desired number of pods | `1`
 `resources` | kube-lego resource requests and limits (YAML) |`{}`
+`rbac.create` | Create a role and serviceaccount | `false`
+`rbac.serviceAccountName` | serviceaccount name to use if `rbac.create` is false | `default`
 
 Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. For example,
 
diff --git a/stable/kube-lego/templates/deployment.yaml b/stable/kube-lego/templates/deployment.yaml
index 41c48d30ec..846a519a6f 100644
--- a/stable/kube-lego/templates/deployment.yaml
+++ b/stable/kube-lego/templates/deployment.yaml
@@ -19,6 +19,7 @@ spec:
         app: {{ template "name" . }}
         release: {{ .Release.Name }}
     spec:
+      serviceAccountName: {{ if .Values.rbac.create }}{{ template "fullname" . }}{{ else }}"{{ .Values.rbac.serviceAccountName }}"{{ end }}
       containers:
         - name: {{ template "name" . }}
           image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
diff --git a/stable/kube-lego/templates/role.yaml b/stable/kube-lego/templates/role.yaml
new file mode 100644
index 0000000000..8fa7eb3762
--- /dev/null
+++ b/stable/kube-lego/templates/role.yaml
@@ -0,0 +1,40 @@
+{{- if .Values.rbac.create -}}
+apiVersion: rbac.authorization.k8s.io/v1beta1
+kind: ClusterRole
+metadata:
+  labels:
+    app: {{ template "name" . }}
+    chart: {{ .Chart.Name }}-{{ .Chart.Version }}
+    heritage: {{ .Release.Service }}
+    release: {{ .Release.Name }}
+  name: {{ template "fullname" . }}
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - services
+  verbs:
+  - create
+  - get
+  - delete
+- apiGroups:
+  - extensions
+  resources:
+  - ingresses
+  verbs:
+  - get
+  - update
+  - create
+  - list
+  - patch
+  - delete
+  - watch
+- apiGroups:
+  - ""
+  resources:
+  - secrets
+  verbs:
+  - get
+  - create
+  - update
+{{- end -}}
diff --git a/stable/kube-lego/templates/rolebinding.yaml b/stable/kube-lego/templates/rolebinding.yaml
new file mode 100644
index 0000000000..5a48ca212f
--- /dev/null
+++ b/stable/kube-lego/templates/rolebinding.yaml
@@ -0,0 +1,19 @@
+{{- if .Values.rbac.create -}}
+apiVersion: rbac.authorization.k8s.io/v1beta1
+kind: ClusterRoleBinding
+metadata:
+  labels:
+    app: {{ template "name" . }}
+    chart: {{ .Chart.Name }}-{{ .Chart.Version }}
+    heritage: {{ .Release.Service }}
+    release: {{ .Release.Name }}
+  name: {{ template "fullname" . }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ template "fullname" . }}
+subjects:
+  - kind: ServiceAccount
+    name: {{ template "fullname" . }}
+    namespace: {{ .Release.Namespace }}
+{{- end -}}
diff --git a/stable/kube-lego/templates/serviceaccount.yaml b/stable/kube-lego/templates/serviceaccount.yaml
new file mode 100644
index 0000000000..8967eb1a75
--- /dev/null
+++ b/stable/kube-lego/templates/serviceaccount.yaml
@@ -0,0 +1,11 @@
+{{- if .Values.rbac.create -}}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  labels:
+    app: {{ template "name" . }}
+    chart: {{ .Chart.Name }}-{{ .Chart.Version }}
+    heritage: {{ .Release.Service }}
+    release: {{ .Release.Name }}
+  name: {{ template "fullname" . }}
+{{- end -}}
diff --git a/stable/kube-lego/values.yaml b/stable/kube-lego/values.yaml
index 3285b53dac..d6f4f93b72 100644
--- a/stable/kube-lego/values.yaml
+++ b/stable/kube-lego/values.yaml
@@ -44,3 +44,7 @@ resources: {}
   # requests:
   #   cpu: 20m
   #   memory: 8Mi
+
+rbac:
+  create: false
+  serviceAccountName: default