From 94bd0f81fab313313f2677793b593fec4f073565 Mon Sep 17 00:00:00 2001 From: marcopiraccini Date: Wed, 1 Jul 2026 15:30:20 +0200 Subject: [PATCH] supports for ICC managed deployment Signed-off-by: marcopiraccini --- chart/templates/serviceaccount.yaml | 15 +++++++++++++++ chart/values.yaml | 1 + 2 files changed, 16 insertions(+) diff --git a/chart/templates/serviceaccount.yaml b/chart/templates/serviceaccount.yaml index 72e9cdf..7b4f606 100644 --- a/chart/templates/serviceaccount.yaml +++ b/chart/templates/serviceaccount.yaml @@ -130,6 +130,21 @@ rules: - services verbs: - delete + {{- if .Values.services.icc.features.skew_protection.manage_mode }} + # Skew protection manage mode (opt-in): ICC creates versioned Deployments and + # Services. Only granted when features.skew_protection.manage_mode is true; + # observe/advise modes never need it (advise applies via the external actor). + - apiGroups: + - "" + - apps + resources: + - deployments + - services + verbs: + - create + - update + - patch + {{- end }} # Gateway API - for skew protection (opt-in) - apiGroups: - gateway.networking.k8s.io diff --git a/chart/values.yaml b/chart/values.yaml index 8498560..4856e4b 100644 --- a/chart/values.yaml +++ b/chart/values.yaml @@ -83,6 +83,7 @@ services: enable: false skew_protection: enable: false + manage_mode: false # Grant ICC create/update/patch on Deployments+Services (manage-mode deploys). Off = least privilege auto_cleanup: false # Delete expired Deployment and Service resources http_grace_period_ms: 1800000 # Min time to keep HTTP version draining (30 min) http_max_alive_ms: 86400000 # Hard deadline for HTTP versions (24h)