From a67f3fbbb09c2330ae249e1dcce41cf866c896cf Mon Sep 17 00:00:00 2001
From: Chris Werner Rau <cwrau@cwrau.info>
Date: Fri, 23 Jan 2026 14:34:50 +0100
Subject: [PATCH] feat(openstack-cloud-controller-manager): add splitMode

This allows the user to deploy the controller-manager split between the
management cluster and the workload cluster.
---
 .../Chart.lock                                |   6 ++
 .../Chart.yaml                                |   2 +-
 .../charts/common-2.14.1.tgz                  | Bin 0 -> 13947 bytes
 .../templates/clusterrole.yaml                |   2 +
 .../templates/clusterrolebinding-sm.yaml      |   2 +-
 .../templates/clusterrolebinding.yaml         |   7 ++
 .../{daemonset.yaml => controller.yaml}       |  60 ++++++++++++++++++
 .../templates/service-sm.yaml                 |   2 +-
 .../templates/serviceaccount.yaml             |   2 +
 .../templates/servicemonitor.yaml             |   2 +-
 .../values.yaml                               |  30 +++++++++
 11 files changed, 111 insertions(+), 4 deletions(-)
 create mode 100644 charts/openstack-cloud-controller-manager/Chart.lock
 create mode 100644 charts/openstack-cloud-controller-manager/charts/common-2.14.1.tgz
 rename charts/openstack-cloud-controller-manager/templates/{daemonset.yaml => controller.yaml} (69%)

diff --git a/charts/openstack-cloud-controller-manager/Chart.lock b/charts/openstack-cloud-controller-manager/Chart.lock
new file mode 100644
index 0000000000..9085110c1a
--- /dev/null
+++ b/charts/openstack-cloud-controller-manager/Chart.lock
@@ -0,0 +1,6 @@
+dependencies:
+- name: common
+  repository: https://charts.bitnami.com/bitnami
+  version: 2.14.1
+digest: sha256:ac04d66e6abb3cfc89f4c10e49d79770c352c510744bc51e3595937721b7f41a
+generated: "2024-01-10T10:12:58.796725699+01:00"
diff --git a/charts/openstack-cloud-controller-manager/Chart.yaml b/charts/openstack-cloud-controller-manager/Chart.yaml
index 00782c7123..2c23035744 100644
--- a/charts/openstack-cloud-controller-manager/Chart.yaml
+++ b/charts/openstack-cloud-controller-manager/Chart.yaml
@@ -4,7 +4,7 @@ description: Openstack Cloud Controller Manager Helm Chart
 icon: https://object-storage-ca-ymq-1.vexxhost.net/swift/v1/6e4619c416ff4bd19e1c087f27a43eea/www-images-prod/openstack-logo/OpenStack-Logo-Vertical.png
 home: https://github.com/kubernetes/cloud-provider-openstack
 name: openstack-cloud-controller-manager
-version: 2.34.2
+version: 2.35.0
 maintainers:
   - name: eumel8
     email: f.kloeker@telekom.de
diff --git a/charts/openstack-cloud-controller-manager/charts/common-2.14.1.tgz b/charts/openstack-cloud-controller-manager/charts/common-2.14.1.tgz
new file mode 100644
index 0000000000000000000000000000000000000000..f443a7c4b9bb8917a2448f681e6dd00c53efbc81
GIT binary patch
literal 13947
zcmV->HiXF^iwG0|00000|0w_~VMtOiV@ORlOnEsqVl!4SWK%V1T2nbTPgYhoO;>Dc
zVQyr3R8em|NM&qo0PMYcf7>>eFx<cODb7o$8!NRa$=9xDJiD%wPW?7bymp#Av(0P^
zk&uL%B3J;Fqb7bn`}4z%1aG?7vYqUhGr!a#frEpCgLA_H5YWkl#@&-KV#1%HN%YnF
zpI)!m+uz+)|Lyg9<^T43+dE(NclUOCJ9`H^2mP;l{q5cT{jZ>R2e?$8lncbZ>fO4n
za_7E~2gNZJNDvzH!xlh*1RhZ~JA~7C$PgDS4MfUt3m_r^jydLsaGaoEj62(YuZ0rw
z7Bfz0d<fI+7D|%r=eFP9_4}<5^MH{=sCUQkk_;GPGxz~V6Hr_SL&{*pXqu3C1ezZq
zq9YQ(0E;V(V;B$-qX~gPmgjy8;LVtD{Syd>m<kAS644nNL>LA$AcEs)=(omnf)8OV
zM8XfdT?5At=%hsgiBQd#Zb+}<h@y~pBRZnoe(OvSyY!QI)Vjp8E6PHC*y<R3TOAnV
zD8a1N0f8q;gamGNV3@{%?0BnVyU>~-5(`9P%vALlN&MdabcGn+g3~yVol9AiV>TjU
zoDLLX21Zwtp{45@1UOAufECQeHN`B!hY;zZXiZBa_RuW(_}t@T<o^^!Ddu;i02avq
z-uC`}S^gjF>^{o>`*=3sgeEgaMq^PFLmO~$_Wb{JUTUe|ISp|v$dF)m2*+o~CqKMU
z^1rpQ0hw^ol4xTCPL)(<_>Yt@97=h7a@sw44uaB%1BydP7!5GznESH)fAUL`0RDg`
zNrc}@R%~r-wA|lT&UKUodlXS?d(8Z|N{e@YMZ+P9i6EH!B3X+xm_Psf+k1Px(){1s
z+dX)k|M&5H{MdcgY7ha-2!LnZ>+4oaLV+on90JDzh9tt$#5kHr;s#@U2zjyAITk64
z0Rg8&0Wl5nvF5lLgjlm4jawf-0*Qkt4Ka9{M}3DeWi9SY03K|HBoN?T;+Y5D_pe`j
z;Aw5<!Dd9b0Pnlwb5H*J-(I^7o$G6j^v91K-QdC&WR-;BA!ZDR&r?R?(M2%EVH%Nm
zbUKP@_WH#K9Hh$BZ2@#ZSHf|C<!|{+kO;;vJ|qltZf$P;bl?)t4&mcR@GtQUuCKE%
z05ri23Cg5Z?!4CBJapaw$X+oNk1+W9a}knkM>YYU;E$9FT>dJn<2bahudw8bL+H2c
zhfZ}I$B2cu8b=A>ZpTr#AgfrVwEQqi2p2fQfuQUSW)nm3&X+Wnb4KqL1DB1Noa`QW
zdbZrj2<pMpeIi4^e}FF=wQZW7tFOyR4c`HXBaVwuHNUI^Ro5s$HT0fCdqEQ#(b4Qj
zyaMT+O8Ee|?-Z4nCU2pt#uwa|@JUuiX(Z=nI>0Q(0&}0x?wE3E_+f8RH<h4IXlU82
zEB}rKS)J_?8kWR<Kqm=}aV#>H3sNrV<Ru#5h<o6_)t*g4L;VUo{6R4ElbpQeLgg=Y
zgf;cg^6n_1Py$l^ED?<b{vbSfvh>h6y|om6lJyr3kMe=>z|TMAWgSYm#TDt=;1|AU
zwJJoYsaYvgtX=873qnc)3!+l+=Bl;`$qLd)qGzRdE?p-%>W6BwZkCx&RpkD}Ws^-X
zJXhebBAN4X_RU|=Zo?;tNh}R0==X|Z+6c6m3fRPxM9iEaZkLNf!bmKJ;Grb(i<2>{
zbO>K7q%wA>H0S8|vYvTziDz5zL`iKqXjNt?WAsETIHl}Ny;^ltY1o-rs`70lo?D__
zwOtB5tmivb=X2zuC;uDRs46eMJT{VQQUC2|#QtjfURlcPQ-lS(`G374%x(C86-BtZ
zuhOX(RS&1`zICVX(n9L?BC19}-B8OdEu2bC-mzd>R--)_KQt(=FM=WF>Z{L~A(l`<
zYtugW<NWKE*5La)zSR0$e@8DZ^86n<&fD}<<NpCl(11j1Tme`R|KHp1?Uv&I`@Q|`
z$N2w!JP#KC7h?<pu@M&VV<yhQ<RUbRh5~a+HDJ<Ba>I}eGXr!K(E*AIbGiJ{h2a*Q
zQ>x<>Q{uz<ZEZXM#KrT+ytZ$l*ajLQyE4SIvYr-}QWSD@P?9j3FoJ~q+vfSGbe)8T
zA>k}lX+4899AV)vH)aWqNHFtrc!iPUcrwN8giaE~FnE9M``i6a&#T%e&3xduGl0ru
z08cmBo%RP<puSfmYg5^3Q1hm=im|w&?9z06IVzbtXDbrx;MTOl9|VroYQ}Q(GKi9R
z<X?WPtg&^HE?_kNoeq{Hnk{{wyfu(E;&P<2Mb}535a9`p`O<SQFTXU2`n&heQYcCI
zddZ|R11C6MnofCze<?z7fdn3=(efPS*0@hnnXW$skw`pZnDZqGWJ@;?$LeTPY|bYK
zLRM;tBG$io7>2EH_}_2caGlm!i?Vv8+I_3|^Y4yNfMJuqyyUE60~D+vZ*FfE=>}6V
zri}clvgKDI;k@eWBjw5Y^JNJbuy6(X-JbPOLUOiWiF6G$*GIMEv(pRArX;{i(heoW
zR#={dy>*a~;Su42t<Haqb=OD6A0%tjSfB{bXb8utpgcekW=m3aoS+p9_nlSAX=2gs
zf`*lp+pf^cU{2yuce<^LEFf;BLK9gRR$kw5yv0nA;HHByeH@Hc27`lOsnXkLG`zq;
z%7~b0-yH}Co+b%p0*6aRNO<CBRTj~H?`CpE$Cwn>t9SA^oDh}qctYbL8KqjN+@PnZ
z7SM8?|J%_`IPb>2U#LauyK*Z!+~EwY(=HsdDQ0qV4vAyxp(q(IXQJMe8J9w1IW5;v
zd3|!#ncz1W>7=RpeU5cP!wxrC<h=K=1HU9rOGR*(f^-w<E_oy6IMkb0%~FMwdprKl
zH-76FuFwnwg<y<>%ZAcdNN-mqv0yYz0~|sc3le1ocKjW`2UkRlOEG>4#!zqzuEr!7
zgH)u5#2iozC=AuoEsDVVczx{wWSe*Wmf0>V(IVV!8*xCu@CbiUtKC3iE-(s#4%HI%
zuo(xqzJ>t~P|C4}OyZH6BC_9?Snu$)Wl0Qw-SKy%qnAcPVgLv{5(~_RD8Py$Lz>2+
z2beJ`?UZM4C=4(#JfTw@!qph-$r&JlB074?VM1auN#nZFc=l|`_?1>Q+`+Xl{~XGA
zA2+AJ^g93k&-Sxl{^$Ci&#teZc(7R@4}1baF9eg6a8~6PDw>B}|EsS5ssUKr-mk9~
z@BiG{-aRO-|Lz{_?me#m-p6yF>%Xe4H)BTA(OA!OJ+0GZ#84<_P0HoJIu$5EoU3j2
zW^W9LF%lp_DseHux}4u?{mjt_AF3(!WQrmZDxLa5Hqh(A;ZY@pBQM0w&Kh4f9ARI9
z%u-v_H=XgAATjm@^(|Jto(CSs0mCBu<CWSB;SC9nLRCc<?euzHuJ9@t_U{VA{t6iO
zGYl)J7<r%v31{GW6%)5xS=vv{h*U|?E~bS_mO8h)hi!w9Acpkrs}7V~gAN$M+W}kC
zhnEroI&?})rAXotmugyR7pdX5q^Kuq&$4DcBH)U~PX&lEqgPfX$#!i{TL(_Ezw-9Z
z5W}&sg_>=`MI_CglrpJQ2I=pV#46RbN(DDj3dLbfed~Su=QzTMWB-)@tno0lO~VRD
zL({_}@ZQH~#}^mxUY|d|fEVZIug?$RA2ikTF=2E{LJTvSG6+(psF2U!(j=E!oSDYG
z=0=Z<MOS#~y^o>%yrKeY;ee+&1~e3y0mIUiK~bdoz6CT2Az)YuF%)r_pqXTV7~@cz
zL1K(&_U$E3q=g2FGzqwny_wP|onQzeL?(PKXn&tFF~$r?Jfv)*xidhqY@ZI)5g{QU
zk)7rd(t!K!F(o4$V}_#cm|k@R?FvTIL4^63QqdXXXri~ucL?Vx=G~3F^Bv88ovSg4
za3>oVQ{IdWzd;wjE>$uqn}uRkhWrFWL?VZEKQ|NUfAv$f|HuT5*0=ZntHt);!9k7v
z*L&Rme=pCy+kZ}+C1Es?0#GuXIti)H{4ngO{*&jRtDonT3TI=Bv46xE>(b!q>^-lX
z5U31{Cf!_YFSFXr`pHaMP%1?{!@#$n+`<XvM9_xf_G4awV`<z7%9N@-blMe|O-QV@
zLlKTZBiG?{W9jvYk0zH<L$Em8eD!K4j~Z%pnz9s~zh!edrXd+&E?jh+4j+N{pCw)6
z_W7s=P))B(jTd`TRY~60y!$nm|MN;^%VXzYTEMFkf~vNl!LJT+nGmI!I?rivi5Z+K
zcF#uWLfQHtTjQ`9;)LM<2^=1R3f2_(oZ&dc>@1BUU5ncgP<zf~O!DHTDVdr5jkB`9
z)%<O{-85&HnX(0}9244kFQ<?~PtvqJGh99~$1b=Nz@<?q+vZ_FT#`6E<={<FlJ5n`
zOB8T80+b|jWD9S7DF91=3(U0&tTLQ@7mCYO#b1R@MTVvY&Ng3?FPjc^;;WVrWC)w?
z&LjtLTd`xAD-KJPDxmTS(wO{VcV+3L`_$nbC3FhdtWOHyDT-1gq{uYU6zTF<qi@bs
zugHhBPxzAKzhIKr;InwDo3GY+mwMFxT^Mg$qIm;>8QI!$_aY`Lt1KdkOn^v}rWhLX
z%zSdFY**jgYno)MW3&`Dt4!60mRXO3@<q!}?Jd|9q)if!D8t;mW_U{E`)<OpiH)d`
z4g4DnQ4|eOaLM(eA7TRX190crPgA?pw3<7kn()Ba$L200EvMx*ttaZk8#G$Rndm;#
z3t$Nh8J*OfEBh1T+Jp^xSFa0q2N4}~w|9nn{Sfbbi+bPg?+1H$*c%Lk-R;57@L*>z
zIN0g;4h9FkUe_S#kLbqB-G1lg?k;3qDz3l%_CK3y`R$wb=6m1#^&jq^9rgXV^WUiR
z=ljk-zcJtP7wu<lS>v0f%02nbp;f^<v3zoPWR}7k3TBQ#=&S#GSylfh^t-hFv!5h(
zf1auS&UY}tSIpoaXZ$wbe`xgoYvMm9n|yr%pat=t-Mxcy{AaJ<f876hFVFq&|NOg(
zTMG<QbV>%ru{2jz0H1K_o+e0;L4<V@1d1YegXr<usg=~+UHYqvTEoVsl}z7pox5vR
z!pv9m%X~YdQq0<K=2v-r>daY<a$sf)QNFUgfer!1fIkqfjBiuY_T8;5+sSHoPh;VO
zdZkQ-P0AonCj-pd5~NgKrkW3@0<K6D!2p9`DCTk=hf*blWT=jx6fi@R2tq9F1c^nq
z+=a|~7*HnBB(cCFTv_URE(zzZbG;ek?6Xbzuo5J5HRdHnRR$;1Pfoto;n9MeqPopB
zwaKNF!6yEr0K9G+M!Q<7dC!Dyz!`aMkGQOmf0qMU_^w8_EaA;Jb?9UhK!8NTaszvE
zs!97*52aUWLl&*Tb3eM-U6NE5Ac;j0T08$Xj3^TOyXEh;ImN2g20uv_t1;Q;$Gy&U
zW|v^nP&Ij2QVvKH>CG&`pw_dC38;$&gU$UpGf+HjOfF*CYBh(^HfvJ<zg;;wu96)$
zL=ngH)7~_3ZkE$#x^@yF&Xu&e6+KT&&{m{twffwA$QzLN&Z(ObH^5AECMZTDwIXd2
z8k{RPl=OV_@&Y&+#W-xq3S>wEX^DaCqEx3uJ1d4TZuQnV9_BYixUES^71DrrQ#o#3
zL*(v8HlQ6B%;Le7uz%8^r5eCo<j#u&slk1*a@y(meD7sWt2RqTi>fi=KjIk_Kzn6E
z1W_v86ulJAq?li-+JfT6Lx@DgJ1Cf7ukDJr&pP!_JyrYP9Q|~E>%Y7G-SYiEyZif(
z>%aH%+`s+r81r19I7BSer<B!(p$#|MlKF9mwTBz(O4YN-=ASoJX~WStC=T=aUuw2p
z_+lD!GX3mXEr&-|QdZ6`(;BX#zT|7}8||4{wB8s;6Q7T}CJ@w6&4!8cdewGSa#S2R
z;In)%Wogz_(ULLj3}!Wz%#O&c?>c|omO5#QRXq7shfzdMteTdyD3)I%OLNDg8tR;2
zrjiDnNN2uYQ8>5GHs7u}(Xd@H)a%Ew_EfjRNJ>D3F`QGyjv~~yXU9*Q*oC31EuRlw
zv4$PD!mw3_s}^K-ZB+RT`gw@~MRUmzU+t2hF_6h573u~rWq?ZaGZ+Kn<^&I)CphrA
zIm^&Jn^2kpd>RxB%#kL=V-4pC6z8<mvNUPE!w{-0(JK@S>2F7rCP1f{fd*#8nhDUG
z)W?Y|sr`3@Cns@$frzK-_^TO2<Pt|VAYy%chS8;Sk_q3k{y*OWECRpv1HHmi%(gTj
zGLdGU!Aqia#fZw1#ATuDY;0jIT~g;$;)xuS2^J_s0vXbok!kkq>nOYqaSCcK!)8K)
z%Nwk2EI72Z4WCqu`yXf$)yhjff#(U*wr%pZLVk5&-BzJ{iThe5)v8kGv$b&_pXR4(
z|7$*2qxrwk{y*sT%l7}?PVdqFzmMnM^FLpFNTd>wDknApa<#2b*&K~(#T8DSyofmp
zQPovq$m(rb^7RxmMnWv5BTM4|_IK2uWO9)XhvWlzou;cxP8gOJrC!rjXiA*z${#W&
z%V3tHuC?i+4j7}Z5M5Haf}O9qSL}%X+gf0sfZ-%U0S50I54>N!n|BIjgd3(&G=o1<
z6v=T7rJbTW>r2x{L09F4Y(rwsvkjk|PO!TwlSd78*eW6uViqC9m~hxMq<a49LY7r4
zAqfuJe(Q8-_kw63*_Kv^_9S26P;^(DRweQV+xaw?1uKC>%P00@#w)f=V}YgU?uHPb
z#3l!LX?}I^%*dgk6m@QfYvJw62$s3908O{M3bV~O`4=*wUZuiuF#95Tu{o5gxiRma
z!<g0uk<FN;$h@4{mt!nY_2aGaWG(lU3oo5iHwPzovN(;-nK5%qtzp_^<S90_?9{0>
zopa>tzTSE&)k0nOlsb+gdgbn_Q>@4nsV($2N2<vaVtt6kB#i{=<b@o!5=aaIoeb3O
zGke|kVx_F$)M#e6-?}YV;Hfva*V3p_k*Pxw%#K5MJK$5ElW1A>QP<DXa5s2(`JD3G
z^SnR<+;6W$id))$Rr_D>6u!UwpZ>wlZu$K8y?*cU{^xsn?%n>+(tk9c8MQe_Z(4pV
zs7jkqb7A(k*DX61%Se@~q>_|HdOmsJO=j7j^AdbYpgQoP@S>aTJ%63(Ggx$vjKs!<
z`<xUYyU#|wcWz#X5t-uHx)mxQ2kPRG%-V2{XOTs$oTV}LL8$?~qD+Jp{5m_t?v3C4
zJ>|j#A2Z^&Rh0n>F0T*^^8_ps5i#=>2H%i)NDu20K(o8Qm8$3phH-a-NZc)63cg``
zuiI5Ltqg~|hd-yIzDwMMh@+X*>{l4ZXev7~#SBGdigGFW-9w-6I-9A;p%nvWv05nP
zEM-<#4S@=vkIMST7&_H@E2>tz4p8R$+_qAA-Ictfc4_%1b}cN6bKM$Ft?AcT)I~I>
zfbD+0sZf?Wmw2|6(7AMO;JJy+(bwTzVzu?pdlW49Ay_W)to}HVS5CZ17P9g}Rb4#2
zFY_C6JNgQ!!y|pcb79)n%$nj&SCx5FtkEuHdsiXK7JouXV)OK!eIXK;BOq~zKg_H3
zBtyD+BgewYW<e~TYuN!VlmWwn5j@3`v($P}#4rkH5GYeVTxw3{$EE01O((UtaM+D?
znTvA}Jabw}__laGRr&m!e$AOW+g=;I2*)Ea_MqQWV@Tx~svNSS2VeMmZt}31`W23a
zPJv~g>XCe!9hVJPW6boTUPfcWfeR|xecoIsL9Uq$`ucj8P|#85>HJj#`&$uOSt!|4
zKJ0$O8lkiW*dHBA6O8{6Wfb;&ct@fL)H>ggFfR1DKUiR962i^=3^g!~svZ;QsQl7g
zT1uSt7t_;`;mr^jibFcd2&cj5;e-x+M`?snTm<!QjMa%Pf=b5{_-rzu5w~4l06LFe
z)R;M?@z6mWC79LOIUEt=jmz=Xrj3m~@pNEf=ZnrKf==atB3WgKNc1{>g|C{r{oE)6
z*-w^YA5MqL%okL%{TA>`lIT;CxOKT>d?ndRQKzh-46QFo^4<O}j)Nr{Rt>o=OH8&P
zrmoUafjM(F*Z^_7zY91H*enrtI><KvOXVrtrb(6Qz_U0Y3e^!pjHYH?!_FZ&DJToo
z89(O4Miqe^rg5OQ{4<k`i^`%>N`}7FyjnVD1gwYvE&Vr7hk$D2gKSG-mBtc_Y|X_^
zY|FY&xv7~?H5)C>aMg=8NYpfwA491miJGN(TZr@Qge7=-iDz@05%!!%EjHAIAiT^%
zxxBN3ph=0tb_-zJhqLU^Fx%BBL1hV)6HjWRTo!VRv?Whb5YEM4ZK_bxFO!GJm9MT<
zCP_L*rh??HQopegfEiIu!P-vm_;9Y|PBe2wQHflp$H!`V8ZlL+s2M&ZQ+a{|9ab}4
zc&a}<EeK|fP~NcYTaMmB+p4P5GpplChS}i}cphYDrWnCjdY#MJ^1Z;>2V2wvHY&m?
z-|vBMx}Oy`JYYHNM{WO=jg(Z7i2EZfe#Eoy8J$R#nHeaOw><DmdbQ@x)OKUDZ|xnW
zjSZ_3vT67BP-O$v_F-=8dU&2Afs`W~QF@ss;7z4%WZj@8BAOXoGu~}Klpvk+TAYSl
zd)edzxu1P~_iDZ$Gh+{H`BqAQg2Dc7hy$ox`>FRQ{{eok1eMrt*PR(ta{}I*T=~5B
zzUJ>e2r1SF{2HN{*;o4e``EKYu(*{^KQpK`jC@1S8%jG{dh3r@TcWWWHI)G`9<)+A
zHvz|J5aF<RGLW6tNA6s1+GPI3?y5L*ghcsh%zD1J-hv$tdn%?H7SE#LIT+PlZk!KX
z1r>F^-Hi_StoEu?9g4R#CqwEJH|r5`9MN^1@Y#$@tyC!<4&WPOyEOP0f@M9~jOZ0+
zuqidwag>Y^^xJLy^Hn;*j0Dhc!)BT!)l#3#F`2)5O>;(-=K&!VP0&;UkMM_coriH8
zMK6g^;YaWN`*#j4)Ol8)q+QMhgS};eyXQuE871-(&iwiWe4Gx45iSX|dHs}hd6iD;
zv1xGnouGy9SnFl=sboTq=Acljd@7h@fmasMTp})5UiAu1{!supZ+lkCF?Y-?b*@2i
zf3B1TTR^3wcSX3`fyIFca|*Gx=d77v9MC0V7Fu(z8mTbtyfsOzMruxGTH=18Q3bbC
z4Nx9Bny{i5z0kU~qn`y2vzz8U=jGiRTcspyx3$d%Gt0d##h~11W0frmzc|cQIK=`5
z>1HHI-F%j|$}|I6kqO05i+90ZnTQU8gyAWnDX;oY$aTW`GLv1GTr}AqZ1%3m-HVvp
z_O`^w>*e99ukeN3ukg7)HTfTcGBm>Xcm7L%`(V4A|Is_>Kjwej$MaC<|GMXIU1*L2
zwdcQ9uo{*OWPyC+d3HQ|fa_OdodWs6qVqE%OHJibDDy$#s22Vl;C|twYwns81j{RW
z=D@&8wZbWHg|A2RE6rUbS3<K|%Y53zf2c%&LXq;xZ&u5?W%QvZ@4fe)SB_sSSyy{H
z^_VsG=25Dz^Qp@Jd@tR)G{6G+zrD9t-v6_=`*{D){X7pK|Kkv|Y|%rnDP=22S>9EG
z*%&2UJ83+iNp@O|`N5^h&Q*R_vqfIBFBFO!Lu<4~#k&S$e%=*$Pj$(ICn!ngAB<9M
zu<BA)(o3e+!@?{^Y-V3<<{zlu_ga%X?|uB}!KR@9Kc}&&*e*oqeLWlnfiIE>HUlJN
zZIcW3#6QOo5@d=mRQb;Jb>^;ldHBg|!=~BjtLa#%<(byn#jW}E5ip5_X}~?~w;Jp!
zN6w};^xd2a(|y+ZNnwd}oKjygl-*HP<z{;)jT|$(58O8}5{3gDDjP)|e;3;;XB6Sa
zLL`UX?j%2G(>GaCgm!tt$fzqR#r?6EL>r2B9XajPUrWsldq@J*o|4eS!2RY=#Y3H!
zWoUy&es~7Y56-YJ&1t@d)`g<gDEmq$-exS4%|**<`NnYgWHzCz25U~DQ12^Su|IEf
zrK<n+LgGE{|K00V?|<2Q^#AVXxp)1q5A!3jzMWJZr6nkgu*kDuOeD5hcxe_jLFEw^
zW=7ACx7kbY%v)8bV_z=0U#_8HM+q~V^<9s%YVQqw5l`PDW)HN%9}>z0NC{#ATwfnO
z*}O~#I1rH{j*SR9+qUMO;ZTaCIp?#OLm5pB4LTHl=QNg5{K)&LV#U5Jq0a!kmU{Y=
z&8F(8TS3aI@Vk^mA>eolQ^a)AkIpwndK>1#fh-Y4kD?u!$*hw_^A`_I36v9eR$o+3
zd=e3*TDbf}T@fhVU(;cyhFVrUK^%Wysj75ir+ff?xeeDjZ-kbg-`-SW6Z8V75A7QN
zSpCe`Ivb%hr0R;?5?701Myu-)TsU%b(@nDMS^aCJDOLfTN0()9O!AF0g1%Q=hp1m-
zQ7TTn9{espJSn9kl+290rAi971E*7yD3a)1m<&$|)*CaW=wxP1iw@!G*ZiqjPXH2w
zHMyQNWP}uwv$F-1O}iA6BU9uM=flywrIBm}Wh%!n&zO2*%>B;wHOyH<(aUO<hEA?p
zVPOp@GbPQ+g_=St13ZG5#vN078J25KttzE*U*cK6$cHL{dsR*>v{&8$V7jl;2D5Jr
zPch^8NBQ#b2+U7Ys>o$-(efbQEX}Llur0c64m*@~5BLq4LUjz|>;tIdkdrYEE_pfu
z<ak16cs%PRNp}drGo1kQEMLdk)EDIcgpw`0FJefUy1|OXkkG<8s#}0RNIKcgzV_5A
z*yI?)M*rKLgZ=hmiy|-xzcJWmbk!JpU44uE1SM+Cc~zlS1)nht)gsBFwP_FeHv-Dm
z@V`SGpGhgA+^)8(-!nJGcq4Q|ga+)n2V{GfBvyLWkjTqDmQTRPXnSv84%wICy*xg*
zeX9Q76=HHyuF(Ztxc=9#tp9EAKA!)2FVDUEfA2JV0UFR$m<!(-jUpww(P*BK&N$PQ
ze}hJI?#nr+RLqmfwb0x(Gj&#B9tpJ@4?S?M@NAnqj>;G4eA3B+-;+25ufyKI55IZx
zNlVv5PhWrZ?)d!G>8rmV!g=0%2(iF{z#(i(AI!Nb^!oZxzL90FuiIN-Y|J>j`&wV<
zpmQpt889rniDR?N15GIjtJGHJCxV30P&?z&jU$Z4dgHX(p4of@wV@4W++ISh_L-;y
zCOf8;j%=mllyt+Yk1FQDpNjl<l9Ri?28eSMhYa0H87zwb^|#CCe;ge29^-%a^4z=p
zH>u(nPAqTbHzQ=3=jz}tDOgno`rHiLnq>N%YcqgN!9jcRPnPX(H}V$k`sH%-iaX5h
zrbLyGmv`1)zsayk%CniP8P-|6i+2pRx?Q^sp>FG<pKVUfTe8PyAfDHyOp?{N`y3B-
ze;ak=vcz?Q4yEnyH7;xp!GNqBtWbbw_J}M6NS7@^2nRoN%+44dk`GIPxx_PHS1LiW
zTT0x`Cb=`5XC0T?Ebe<yW(8&1aClPQ`>$>wDxV^ua%|f6qaldCl%#lCKxOL(FGnj^
z*)~(@ZsVSr8s_yDA(jU|tKaH3z~m`Zi)Da1<1ERy)R^gS;nwW2sXrIm8M`?ru%#bJ
zL=c-f`&jjwhB}o^NmdhMrL1)3$6VpIaH`mo1LugV2M`+z(e4ye2r?8Mjw$aI%VFxd
zRX%6K-33x}cWNETr2(yL;LXg<yRzEYTj^Fm=*tg=g|oycxUu2p5wRVcL;FIIS?wsQ
z-wRl`#Bp1?+s!C?yjP;Rs|u_Ik=Y97TBy%{_PL!{Fy`f1RyUl*FOT{5U-UEI|C=C2
zP&l|{C~$%QcW|&%zW?c9XYbMfyO-zT{J)<hZ$1BR?cSf|+0VxJvmI^p{M4Ss+j)Jq
zjl1#rYDl`0$7kysa3~ey8#{d^SoJO+V!@aQ9Eg<FuA-I^a*CHBrDELdI+ox_MJp>b
zxQ*wOiU!w_IiI{jt2J<>`n73B4vf^iURZyz`#Qh=IZh%HC>CkzPPIf8>SyW_mq)45
zEiM#nc8v{>bmS1P**h*^Q0$FD(q)vJoEKAJxQ5HooUKjzL=`EwOE|Qv8=Tf1gs_yZ
z5_zp*i1L0bxBL16X;=Dq&Rp>35TRjGHFIB0`6ZYzuXP7xs>5kM#r{<SIm>9kwZ(GQ
zXbdca_YHzM7Hkc?n*?%}1heKaj_t$><9@>sP7{<{25>Cc&pdqNiqlo*Siz{f!{E&w
zPPalAZZpqZjkL<dYN)s7z?_`FD~xPzW`B{Rnxns9L|rLaH)8Jln}*>Q#D8c!qIVqs
z>G$?_%lm&1cJ}ul<3IQDJYf7s^49b3{*B?$U)CQ4GK~BA1cBV%Hb;Uq+P91axlP?s
zK&VRI)dE7M{#pV;MOY01q4{B)B8Y}C&cdKlsZ-5CrOz!O^c)E^K)hT(G_UU~pmc%l
z#-3^@Nq<`i={ObR7dfvua5BDV2t%pYFPhnGm3WDZ#R6aS4x(Q=2H~RcS%$@osQVWP
zi|GpPB)d(k8JxwzICaopvCAb~?mi}0(rBMmOpar*L`W_dON)YWrsNV#ugiBh7M<)`
znKee>3?h%Qw`Glu^~K(l@ikbB+qeYYH;D-tuwQoU&2(agaldKotpUnyV{ZoRXC8Z7
zIzrQALEmMBX3c(1V;>fUX`BglgD}mVhD7JNBwy~(+&(U9hwSd-q7NP5S@0}~|Ebfo
zZ@Uq6QU2HdZYBS#-+$cyc`wfc#{Xs)|MhbHfxp7}?++jLQ=Poi%rDi#9fkSI#9S@N
zr)sYy#OFe~Va8VhnH%SOxlkUny&ki@svf?Y(f<NLt%uI_DoD=HDysCrnO>R!AM?B(
zCf2l2=dCZ&v@XTJ80VXKSPJNu9b-~mSbDT?8egh~aogyU0{WT9mX;1;G@EXB8N#@m
z>2>SKg`QVmcs^IX8U4kL=JFxJOd8%*9@kBu`SG8Gaxr4~mO-Ee`Ct8ma{Onz*MHpq
zcR$a=#edE;Z{0-@$YI;hCK8n6)Eo}V%iJy|<g|4+fuVW=uM{0}K-}^em>Nj6A)?H?
z%*wm&*J7wr+S|804|FVO!||2oWEa)9RvTFHi^}E!qbb#5wUljk^Q*<1{o0zjv8E$t
zs#p}mD~3YOK(54v?kMJ?SBxXnG*KRpImBKypfHy?ml}b)4KK{^+2<5!xS9DJ;(&xW
zyL=Q&#H2<vm&F-8=jpsEv!xvS_J+H{A?%lU)}h0W{WedpHC*fKgE~rHVm`nbwxK%a
zo5TidtHMe`yiuvl??KU=E;%s`ck0!aa@uj&Q*%m)KP*wpoXPG68;Ya;V6mpf8g#Wt
z#A0}kqSJ)ZcUdhZ4I3G>+{ogD*?Ldeo?O3K9#aRG`WRBX*qu54bYmN<0$y{d%IV^Y
z9CNdv)f_;#j9j^c^?8S{Y_OwZ60SG|4QAyX21C~C9xUCXJCPoF(Vw#g(Zv!(*~-<a
zIfrk-onuMGWX!cfRLH8HS2Av7?TQwvZ}AQ!iEFIhOq3MO-7lDnYx}c4>E;r8MM+nN
zx&YLg<(=DFa&wVa>)U?8?9$k$1uWCR5=m*AyZkV(+^X^8`SD+dLvs6zAQt5R?eF&X
z%lUu3z1_$7?|nS$iT~ax0DLZ)>u$FHYQFt!V!sNV=CH5&e7lIRZsBf%y%l0E7nar4
zmW#+XCfpT(T;dt`6IHeZNL@LB82J;2=Axs8z?>@n)LxFHF28DyVcQ#&H}m8-bq7|d
zA6{J&MSEebY6bj9ZP#pQuqoW$Xjd<j2UZRi*JpuMlLSM;-QeR&q{>2wi;3hGU79=v
zEPv+sI2Gg7$J4OzVjNSB&sIY7vxw$9S5@W|x=kiwf!fUx)U59kf7`UN`-&kuC;zO(
zZF6$x+>*_)?V<>7Y<T57Ik)vMKXAP$45bC^JY8L{6jlp9)x)@@XQqLEmLVst@$}`P
z))CXaUz*Y?B4ZTi9r{>nvqGBHe)BNvI_{XwC%wL%GFydF^j7#Qh)=ntDA)F!72tYK
z!ltnq;BQCJ-)%2F618T>E%?6{o)heHHIEhQMfJ70g3Z;|y3lK|y<`LC9@rb|jxx6M
z%?~ncYTli(lD!v9#)tO89`2d%|GQe~=23tJ{{Qa5&VD)nYkU83|KGhl510RC++kTp
zIr;-!_4T#wuF9*4eL~}5uP24eX4&M+Zh2O(ye3~iOJ*=8Qm5B5W^zMo{q?ri&stl?
z<ZH6@^gY+Lw5jVt_0H?kFhJrcd)v$UAjg}rxyM{kYl$eV<B<VHV#h*J_aql~JLb+_
zLp&unD;nb|_3d&P;TSU{aM)dbo29w-e^L9onCY8ACPV_&H_@E;u!LQot15j(xSvJG
z3J%j^?$LK@mzXH$VLuz_M!(3{-LAP$d^z(r<1%ya-Tc|UxKE9J@yb^eES!>)S;sA#
zTf@$ukCWzpCr!!Ks6dBKv3s_tx&YVdpA$%yJxr7bGW1uOl*PGIj#=LHX8wG}HEpic
zCbjLD6QlAxH}2$nx%1Pun=qX>)z$84Wu5!U6lFU`<#aHrtWacx#YxH-j`N_R=amCD
zC=N5pVI)Q=eqvi{qMEAohQ5fWZxM5oBpcAkeHeI?yUT$tqFMX!ef&PQ*@$2B_i>G<
zqZ`+l%aJn_@Y@ZEUd0H22LJSH{<JFAvJ09~7{b#|N18>_-8y<AiyJ8*u|RR?OD`;E
zjePW-cb0$^O5E13G4{Vd#?gd~V#@IPZOjGse{XNQy#BX+(A$2r|L^13fHNedjNy_i
zH3vwA5yK!QQ7Gkaf`Usl!rX6dz?(7Qz|$n5OmN_197QTy1tv%YV-k<HfZ+%UGBpY>
ze~;p@wE;06>HOwR9aJ!Rr11Z>eRv&5GoZ1mDN%w1Gl)ox{g(gy;@1nQo?07lqF5H*
zo?Jjk7;pI_BD(5djeg4?{K>lNU;AP_>dJrYPd<&iIiLXwF4IJLExh&2=T}MVnLj|6
zt!KWNB&}!vx3vLp5hFC^aQgfOZ}|zMzvDo(d=g^R)#Vudz2#4NKttU9g5n8g{-3`%
ze*V)7e-hqB8w>V-?Hz3ImFItN=kfgSdwDkCJAI?SoeeL^fJuAfM5>@x>ll9d0Y{VK
z>wj*Jg-G~ew=30#&&S=62D~e1LIU26bkSdx664(sS*EQb*CR&LM2Zy6br8`J31EQ5
z6~=Lfh_2_iS{obi=H*|WpSN1S{q~!*iCZB~a2(<|AlTU5QY#)BcuGT?Am|}%`yc!d
zHeZHvA}E_30u9Jvx6AN|aKUDsz8})y5;LFB?m)M%o0m<hb^{u78sV1g1!V2dAWfv9
znH5v$p@h7(%}@KSOA?2NAYE`W`Uxei2^L72zY=qeca6^@KX8ATMv+ctR7=vf)?}t_
z8}NR>QAFV#Wl`v9BwkW_DQPPxq#OfH8K5Lf6ynkhPZ$kTwaV}x@P^Ic7ai__Hz@uy
zh2y+5oFIWBI?4yy5XTSbq>E#LS;7d%?JZ@<<Szh+L;;|~Y&>h=>cKsYMTStTrBsVH
zd=f^dB*Yw$<rEvAgfWg1%s5<)Nic>0#nR+b%MEH{#S}+0ff!#IE`n4V@|uS$T-&y)
z4JIf?Bh36(tH^|f29%!q<;Qe@QIhZ++NF8phj`l6j2_}7qO*xKMx}AA!K<Hi2x>l^
zX!s<CAWFHw%rN{J!^+*~L}1=(bwIYqVk|I+zQ4WmO{=2;?D*gMy>E0K>4#zoL;bu+
za6nK5Bu-KRJQ(8%QeQUUbb?0soKlhVtepyyy~HfRhrpHF)dC1H4;WFt*C9Mt^8{>h
z$EhR|sPwZU8c5%(1%N-GNfO~h$Yxio<;=nbO`T^Y74<ZHIU8Kah9SH0h{PXSErCXh
zz-l-Gja)E&zrXMIJ0Ttr6nFZ)4%^>pwURW7&S*q}g}5qW4`+Zh__M5Hw$`N#tEb1&
z6`Jv<(p}2%kTiR$qVD49mR_}zeu6B1I($XN8N(dM;;F_*ulMsDA;cJ(wE&2~Itno#
zQ|m-WGvF5KSObw<nW1mmfz5oU58~Mb<ZZvz3h^Ly$UV?Yf)&!}zNqCFGK3jT;fkhF
z2obr&@(afp@CU&Vka$ShM2iTm7q~k}da+RQ_Hhg(<^sh5Hoyk>u(gq~rOR;}1;JnB
zmkmk(hSA>uXZXP#iPi?_t{aS$+?Dg{OiFz&a2()#W|@WHg><s3r@Fi}dMzy9C4!`5
ztHlLnXoOE9#Q7rL{QH=49dOAJ6!4Zt=>)@t1_TPy7Mu<(?|B_>3*2U2DOKfpM&^cu
zOFTJ*Go>!Iw3bSb#G?YnUdL;-P!M3wf1)8?gzm8_2@@LT3CE3i7aBUpD166=z^~N+
zaPsHE#xBU8c!d_e{X1#3q(id^?wN`54f25u3y`cPoy*Rab@ZTb6oy07bpss2mI$x`
ziUJDh4dsS8&1O9NqL4?Fv#qjB7WC4M!r6Qz6W}X!b}}>2FY)Xrlt|m}unfz*&&)s#
zGr@tBJePQ;B)?Jw@=NTrEI*RC2?>oq9Vkz29<jA4mZ7=<F0vZ{Su9Z&vZ*yc;#o#Y
zNlVpXiC8Kn)jR1xUzt2l;5g<)xx{KNs<Urg6M@8l4B}hB=>&ry6U-%mD-^3qIg+)t
zWyf?vLP9ww0}>H2)6FW|Z;T1!Wok&%!jA4nF3G!wR_cAH)2TOK4OMP#y8=XLfFq-!
zP?9WPRS)6o1pSfX%m&U!<KsujHdfeh?<W}S@8USfwrpNsw+fvOlPK@8@B1dqh~w#D
zwt3mQ6=%m67w=x5KhHjZjxB!A=;Y9O35L)r;cQs^GKXAtbaanRpty1hLj4ZI^4dhP
z$xA$&+v24YnO?R*v)?LDY`nf!^lNRn%NB~Pr5RP6{EKE2ymc2a%>;Y(`pt_AUwjY+
zpX?S3#J%4AE)n<oH&`TI_RQNwiGjCXE>>f6I+PM=NLe5?C*|1^zS$VA)*z(JB2lDl
zJ0;3cgrz%Oaix_gjv|oOFHB};%|`{wO9OS}d0Qn~9(kVP_@||!OGe_$4Lq?E{Z|R1
z6rFEgVQ6Ku4u41}6X1Y3da^0~!azi-vR$$3C^?s)0B3uNb6$WBh2J@iC3;8RM|J;_
z?{ML@C&e4$cz+i<VY^jFg8q$2(057DUk?fTcR+%EnFK~?z|YBup-@^XN`$<j(D!?O
zuhshHbqufQ6i)`2L4RipwtL&XE$u>2w{0jJt`G<1f=KshNMgdrILuxA5fS5bpn@Ng
zdAm9~u)zfqDeur>M~rdDM1@sMgm9Rk-zl@<DCz3y3_~tEYz&xeVLuq7c!aqQ*yvb>
z{GLY&%p6k=f}m0;P?k`Jgf?PBG8|$xEJKV$$|R^T#A@wTcXdZwPzs8ihsNYpF^#M#
z(*q!a<7g<ID#Su#S7ao6@%p82r1HBl5*hASm|-9$q=U_}Z<!AN(Q0+zjNz$@rkj^s
z(}Qrg!zst`ThSu<4K|I`P;?l~U_ixKSK3zn+p)xV0Lh`%!8+CdBFyb7OdVYT8b`CX
z55N3?8J-{Sv~f<!11KS;QynGN+sf??P%N1$gb7tN%AH*_psAi$4qm_Mg>%2vfuAK6
zv>9Z=s=rlmn(p`ow1()9?uIGdQOI=+n=imdHu$E<O%e|diFSXjvHeUDR;l}EYS{$F
zh{He{@05jDGBk>kF&bb&0yU$Qg*&DbI>IrQBY%Zv+76Z)V2ra^p%WW3Ja!_PHN?zB
zG1bykYG=EiC?w+~$z7)=)L<-UT^5&1!jRDkAlWs|i!{boC)rq^nK@eu9v@4WA$}@g
zC`A{FXFxblF<-t(ZKIocWEhnPI7W<6DIlcGHX~(%E^h6RVlJDvBFoN46wl;9=4j--
zP<}#bvbkN;lSZP==iyx>hS4Pq4>7ZX>K8g35*2h*#X=gS(z8)xHh=O=w||}P{5l~c
zJ;2?K?9WchaVJ0=^R}5L=2JY<gJ=67C`@+@xBSfUFpVH0@uiBM{?)cE+w|QawnznK
z1Vy~dFsIQJcO-h->ffDCLb>SVsOXXI{>_EBOmAu{3?e$}>N2<^d!pLxOt(9Nnm>2C
ze^YABBwx0i49$NFXfpeYRAW2EY|WM_96}n0CZYW}LBSYXFk4{v9&P(Q*pvl4^T})f
zr6qZ1f@X>hrSw%ipr$we5a2{j|A0=Ch-equstyCfZ~emnpaX%_jF+fdU1v%G60MdZ
z$ziv9b#>(<g`!W{s2k}by!-O><i)ECm0<d}R_o_D!kp*Iaxk+C8&YCN=nAAD88NH{
zJc;3o5uw(cIUNc~qE<+_U}TVr0(mS>go9f^%H<fm;|n;w@Zh`Si_?p(*1OX;KfM0=
z4ZJ%(KR<r;=Jdq{ygrAM*RP(RzBzsU>H=PW567?m0Y9F;dcFmi=#btADLT1CkW7?n
z_gfbj7aF&rE*+F50YoSsrD%j<M5ma=Y6%{*3E^5-qBv|tWI}|Ih?Va6U(oXN<Ma4D
VJ`ec(zW@LL|NmEb(g6Ts0RX;9X=VTb

literal 0
HcmV?d00001

diff --git a/charts/openstack-cloud-controller-manager/templates/clusterrole.yaml b/charts/openstack-cloud-controller-manager/templates/clusterrole.yaml
index cf03f8a11a..41e68951d2 100644
--- a/charts/openstack-cloud-controller-manager/templates/clusterrole.yaml
+++ b/charts/openstack-cloud-controller-manager/templates/clusterrole.yaml
@@ -1,3 +1,4 @@
+{{- if or (not .Values.splitMode.enabled) (eq .Values.splitMode.type "workload") }}
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
@@ -96,3 +97,4 @@ rules:
   - list
   - get
   - watch
+{{- end }}
diff --git a/charts/openstack-cloud-controller-manager/templates/clusterrolebinding-sm.yaml b/charts/openstack-cloud-controller-manager/templates/clusterrolebinding-sm.yaml
index 2b2d160b70..fe5eab5049 100644
--- a/charts/openstack-cloud-controller-manager/templates/clusterrolebinding-sm.yaml
+++ b/charts/openstack-cloud-controller-manager/templates/clusterrolebinding-sm.yaml
@@ -1,4 +1,4 @@
-{{- if .Values.serviceMonitor.enabled }}
+{{- if and .Values.serviceMonitor.enabled (or (not .Values.splitMode.enabled) (eq .Values.splitMode.type "management")) }}
 kind: ClusterRoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
diff --git a/charts/openstack-cloud-controller-manager/templates/clusterrolebinding.yaml b/charts/openstack-cloud-controller-manager/templates/clusterrolebinding.yaml
index 62906bfbca..774f623ee2 100644
--- a/charts/openstack-cloud-controller-manager/templates/clusterrolebinding.yaml
+++ b/charts/openstack-cloud-controller-manager/templates/clusterrolebinding.yaml
@@ -1,3 +1,4 @@
+{{- if or (not .Values.splitMode.enabled) (eq .Values.splitMode.type "workload") }}
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
@@ -13,6 +14,12 @@ roleRef:
   kind: ClusterRole
   name: {{ .Values.clusterRoleName }}
 subjects:
+{{- if and .Values.splitMode.enabled (eq .Values.splitMode.type "workload") }}
+- kind: User
+  name: {{ .Values.splitMode.subject.name }}
+{{- else }}
 - kind: ServiceAccount
   name: {{ .Values.serviceAccountName }}
   namespace: {{ .Release.Namespace | quote }}
+{{- end }}
+{{- end }}
diff --git a/charts/openstack-cloud-controller-manager/templates/daemonset.yaml b/charts/openstack-cloud-controller-manager/templates/controller.yaml
similarity index 69%
rename from charts/openstack-cloud-controller-manager/templates/daemonset.yaml
rename to charts/openstack-cloud-controller-manager/templates/controller.yaml
index 40f98ea3f8..2f0c4595a3 100644
--- a/charts/openstack-cloud-controller-manager/templates/daemonset.yaml
+++ b/charts/openstack-cloud-controller-manager/templates/controller.yaml
@@ -1,5 +1,10 @@
+{{- if or (not .Values.splitMode.enabled) (eq .Values.splitMode.type "management") }}
 apiVersion: apps/v1
+{{- if .Values.splitMode.enabled }}
+kind: Deployment
+{{- else }}
 kind: DaemonSet
+{{- end }}
 metadata:
   name: {{ include "occm.name" . }}
   labels: {{- include "common.labels.standard" . | nindent 4 }}
@@ -9,11 +14,19 @@ metadata:
     {{- toYaml . | nindent 4 }}
     {{- end }}
 spec:
+  {{- if .Values.splitMode.enabled }}
+  replicas: {{ .Values.splitMode.replicas }}
+  {{- end }}
   selector:
     matchLabels:
       {{- include "occm.controllermanager.matchLabels" . | nindent 6 }}
+  {{- if .Values.splitMode.enabled }}
+  strategy:
+    type: RollingUpdate
+  {{- else }}
   updateStrategy:
     type: RollingUpdate
+  {{- end }}
   template:
     metadata:
       annotations:
@@ -26,10 +39,17 @@ spec:
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
       {{- end }}
+      {{- if .Values.splitMode.enabled }}
+      {{- with .Values.splitMode.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- else }}
       {{- with .Values.nodeSelector }}
       nodeSelector:
         {{- toYaml . | nindent 8 }}
       {{- end }}
+      {{- end }}
       {{- with .Values.podSecurityContext }}
       securityContext:
         {{- toYaml . | nindent 8 }}
@@ -42,7 +62,11 @@ spec:
       hostAliases:
         {{- toYaml . | nindent 8 }}
       {{- end }}
+      {{- if .Values.splitMode.enabled }}
+      automountServiceAccountToken: false
+      {{- else }}
       serviceAccountName: {{ .Values.serviceAccountName }}
+      {{- end }}
       containers:
         - name: openstack-cloud-controller-manager
           image: "{{ .Values.image.repository }}:{{ default .Chart.AppVersion .Values.image.tag }}"
@@ -56,6 +80,10 @@ spec:
             - --cloud-config=$(CLOUD_CONFIG)
             - --cluster-name=$(CLUSTER_NAME)
             - --cloud-provider=openstack
+            {{- if .Values.splitMode.enabled }}
+            - --kubeconfig=/etc/kubernetes/kubeconfig
+            - --leader-elect=true
+            {{- end }}
             - --use-service-account-credentials=false
             - --controllers={{- trimAll "," (include "occm.enabledControllers" . ) -}}
             {{- if .Values.serviceMonitor.enabled }}
@@ -71,10 +99,23 @@ spec:
           {{- if .Values.serviceMonitor.enabled }}
           ports:
           - containerPort: 10258
+            {{- if not .Values.splitMode.enabled }}
             hostPort: 10258
+            {{- end }}
             name: http
             protocol: TCP
           {{- end }}
+          {{- if .Values.splitMode.enabled }}
+          volumeMounts: {{- toYaml .Values.splitMode.extraVolumeMounts | nindent 12 }}
+            - mountPath: /etc/kubernetes
+              name: kubeconfig-volume
+              readOnly: true
+          {{- if .Values.secret.enabled }}
+            - mountPath: /etc/config
+              name: cloud-config-volume
+              readOnly: true
+          {{- end }}
+          {{- else }}
           {{- if or (.Values.extraVolumeMounts) (.Values.secret.enabled) }}
           volumeMounts:
           {{- end }}
@@ -86,6 +127,7 @@ spec:
           {{- if .Values.extraVolumeMounts }}
             {{- toYaml .Values.extraVolumeMounts | nindent 12 }}
           {{- end }}
+          {{- end }}
           {{- if .Values.livenessProbe }}
           livenessProbe:
             {{- toYaml .Values.livenessProbe | nindent 12 }}
@@ -110,11 +152,27 @@ spec:
       initContainers: {{ toYaml .Values.extraInitContainers | nindent 6 }}
       {{- end }}
       dnsPolicy: {{ .Values.dnsPolicy }}
+      {{- if not .Values.splitMode.enabled }}
       hostNetwork: true
+      {{- end }}
       {{- if .Values.priorityClassName }}
       priorityClassName: {{ .Values.priorityClassName }}
       {{- end }}
 
+      {{- if .Values.splitMode.enabled }}
+      volumes: {{- toYaml .Values.splitMode.extraVolumes | nindent 6 }}
+      - name: kubeconfig-volume
+        secret:
+          secretName: {{ .Values.splitMode.kubeconfig.secretName }}
+          items:
+            - key: {{ .Values.splitMode.kubeconfig.secretKey }}
+              path: kubeconfig
+      {{- if .Values.secret.enabled }}
+      - name: cloud-config-volume
+        secret:
+          secretName: {{ .Values.secret.name }}
+      {{- end }}
+      {{- else }}
       {{- if or (.Values.extraVolumes) (.Values.secret.enabled) }}
       volumes:
       {{- end }}
@@ -126,3 +184,5 @@ spec:
       {{- if .Values.extraVolumes }}
         {{ toYaml .Values.extraVolumes | nindent 6 }}
       {{- end }}
+      {{- end }}
+{{- end }}
diff --git a/charts/openstack-cloud-controller-manager/templates/service-sm.yaml b/charts/openstack-cloud-controller-manager/templates/service-sm.yaml
index 92b07f865e..b3df823dcb 100644
--- a/charts/openstack-cloud-controller-manager/templates/service-sm.yaml
+++ b/charts/openstack-cloud-controller-manager/templates/service-sm.yaml
@@ -1,4 +1,4 @@
-{{- if .Values.serviceMonitor.enabled }}
+{{- if and .Values.serviceMonitor.enabled (or (not .Values.splitMode.enabled) (eq .Values.splitMode.type "management")) }}
 apiVersion: v1
 kind: Service
 metadata:
diff --git a/charts/openstack-cloud-controller-manager/templates/serviceaccount.yaml b/charts/openstack-cloud-controller-manager/templates/serviceaccount.yaml
index dfac2b15fa..85450da505 100644
--- a/charts/openstack-cloud-controller-manager/templates/serviceaccount.yaml
+++ b/charts/openstack-cloud-controller-manager/templates/serviceaccount.yaml
@@ -1,3 +1,4 @@
+{{- if not .Values.splitMode.enabled }}
 apiVersion: v1
 kind: ServiceAccount
 metadata:
@@ -8,3 +9,4 @@ metadata:
     {{- with .Values.commonAnnotations }}
     {{- toYaml . | nindent 4 }}
     {{- end }}
+{{- end }}
diff --git a/charts/openstack-cloud-controller-manager/templates/servicemonitor.yaml b/charts/openstack-cloud-controller-manager/templates/servicemonitor.yaml
index c1d80f127c..5ccd0e2b6d 100644
--- a/charts/openstack-cloud-controller-manager/templates/servicemonitor.yaml
+++ b/charts/openstack-cloud-controller-manager/templates/servicemonitor.yaml
@@ -1,4 +1,4 @@
-{{- if .Values.serviceMonitor.enabled }}
+{{- if and .Values.serviceMonitor.enabled (or (not .Values.splitMode.enabled) (eq .Values.splitMode.type "management")) }}
 apiVersion: monitoring.coreos.com/v1
 kind: ServiceMonitor
 metadata:
diff --git a/charts/openstack-cloud-controller-manager/values.yaml b/charts/openstack-cloud-controller-manager/values.yaml
index d813226992..b89c0c06ff 100644
--- a/charts/openstack-cloud-controller-manager/values.yaml
+++ b/charts/openstack-cloud-controller-manager/values.yaml
@@ -165,3 +165,33 @@ cluster:
 clusterRoleName: system:cloud-controller-manager
 
 serviceAccountName: cloud-controller-manager
+
+# External mode configuration
+# Enables split deployment across management and workload clusters
+splitMode:
+  # Enable external mode
+  enabled: false
+  # Which part to deploy: "management" or "workload"
+  # - management: Deploys the Deployment (controller) with kubeconfig
+  # - workload: Deploys only RBAC resources with configurable subject
+  type: management
+
+  # Management cluster settings (when type=management)
+  kubeconfig:
+    # Name of the pre-existing secret containing kubeconfig
+    secretName: ""
+    # Key in the secret containing the kubeconfig data
+    secretKey: value
+  # Number of replicas for the Deployment
+  replicas: 1
+  # Node selector for external mode Deployment
+  nodeSelector: {}
+  # Extra volumes for external mode
+  extraVolumes: []
+  # Extra volume mounts for external mode
+  extraVolumeMounts: []
+
+  # Workload cluster settings (when type=workload)
+  # Subject for the ClusterRoleBinding
+  subject:
+    name: openstack-cloud-controller-manager