From b0afdd41905f2cfef26eef7f0fbe3e7499d81594 Mon Sep 17 00:00:00 2001
From: Angel Kafazov <akafazov@cst-bg.net>
Date: Wed, 12 Feb 2025 16:41:55 +0200
Subject: [PATCH] change defaults for account-operator

On-behalf-of: @SAP angel.kafazov@sap.com
Signed-off-by: Angel Kafazov <akafazov@cst-bg.net>
---
 .gitignore                                    |   3 +-
 charts/account-operator/Chart.lock            |   6 +-
 charts/account-operator/Chart.yaml            |   4 +-
 charts/account-operator/README.md             |   6 +-
 .../charts/account-operator-crds-0.1.11.tgz   | Bin 5724 -> 5722 bytes
 .../account-operator/charts/common-0.2.8.tgz  | Bin 4413 -> 0 bytes
 .../account-operator/charts/common-0.2.9.tgz  | Bin 0 -> 4414 bytes
 .../__snapshot__/deployment_test.yaml.snap    | 170 ++++++++++++++++--
 charts/account-operator/values.yaml           |   6 +-
 9 files changed, 171 insertions(+), 24 deletions(-)
 delete mode 100644 charts/account-operator/charts/common-0.2.8.tgz
 create mode 100644 charts/account-operator/charts/common-0.2.9.tgz

diff --git a/.gitignore b/.gitignore
index 6879c2857..2838cf577 100644
--- a/.gitignore
+++ b/.gitignore
@@ -4,4 +4,5 @@
 .secret
 bin/
 node_modules/
-/oci/
\ No newline at end of file
+/oci/
+local-setup/e2e/test-results/.last-run.json
diff --git a/charts/account-operator/Chart.lock b/charts/account-operator/Chart.lock
index 86ed4e184..f435bb7ee 100644
--- a/charts/account-operator/Chart.lock
+++ b/charts/account-operator/Chart.lock
@@ -4,6 +4,6 @@ dependencies:
   version: 0.1.11
 - name: common
   repository: oci://ghcr.io/openmfp/helm-charts
-  version: 0.2.8
-digest: sha256:bce71370622dfe032df80c951a770dccb6deaf3a5ae075335910f754bd4fccc8
-generated: "2025-02-10T18:48:32.141404162Z"
+  version: 0.2.9
+digest: sha256:ce62f3509009553615bfcd1f7865fe5493780567e7f592e14449f44a2ba84c5f
+generated: "2025-02-12T15:44:18.230046291+02:00"
diff --git a/charts/account-operator/Chart.yaml b/charts/account-operator/Chart.yaml
index db72b5a17..e2286e63e 100644
--- a/charts/account-operator/Chart.yaml
+++ b/charts/account-operator/Chart.yaml
@@ -2,7 +2,7 @@ apiVersion: v2
 name: account-operator
 description: A Helm chart to deploy OpenMFP Account-Operator
 type: application
-version: 0.5.69
+version: 0.6.0
 appVersion: "0.156.0"
 dependencies:
   - name: account-operator-crds
@@ -10,5 +10,5 @@ dependencies:
     condition: crds.enabled
     repository: oci://ghcr.io/openmfp/helm-charts
   - name: common
-    version: 0.2.8
+    version: 0.2.9
     repository: oci://ghcr.io/openmfp/helm-charts
diff --git a/charts/account-operator/README.md b/charts/account-operator/README.md
index ce3da22b7..472fdb064 100644
--- a/charts/account-operator/README.md
+++ b/charts/account-operator/README.md
@@ -23,19 +23,19 @@ A Helm chart to deploy OpenMFP Account-Operator
 | kcp.enabled | bool | `false` | Enable KCP |
 | kcp.virtualWorkspaceUrl | string | `""` | The URL for the virtual workspace |
 | kubeconfigSecret | string | `""` | The secret for kubeconfig |
-| logLevel | string | `"warn"` | The log level |
+| logLevel | string | `"debug"` | The log level |
 | security.mountServiceAccountToken | bool | `true` | Mount the service account token |
 | subroutines.extension.enabled | bool | `true` | Enable extension subroutines |
 | subroutines.extensionReady.enabled | bool | `true` | Enable extension ready subroutines |
 | subroutines.fga.creatorRelation | string | `"owner"` | The creator relation for FGA |
 | subroutines.fga.enabled | bool | `true` | Enable FGA subroutines |
-| subroutines.fga.grpcAddr | string | `""` | The gRPC address for FGA |
+| subroutines.fga.grpcAddr | string | `"openmfp-openfga:8081"` | The gRPC address for FGA |
 | subroutines.fga.objectType | string | `"account"` | The object type for FGA |
 | subroutines.fga.parentRelation | string | `"parent"` | The parent relation for FGA |
 | subroutines.fga.rootNamespace | string | `"openmfp-root"` | The root namespace for FGA |
 | subroutines.namespace.enabled | bool | `true` | Enable namespace subroutines |
 | webhooks.certDir | string | `"/certs"` | The directory for webhook certificates |
-| webhooks.enabled | bool | `false` | Enable webhooks |
+| webhooks.enabled | bool | `true` | Enable webhooks |
 
 ## Overriding Values
 
diff --git a/charts/account-operator/charts/account-operator-crds-0.1.11.tgz b/charts/account-operator/charts/account-operator-crds-0.1.11.tgz
index 799a2434cda2b576e06ab46d3b2c8eeb6f271fa5..a94f7e961a7fbc2f7619d4014c2be2a8cee8e00f 100644
GIT binary patch
delta 5698
zcmV-I7QN}*EZQuPOMm08NlWr0t!6UWG)?Z!q}k0RzWrh2Yz&c*#G0=HpcCCV|N9OA
zz9bP3N|fYweL7P|BnW_b92|fj;2_USvY0tZiV0!~aXjMFljn0pn7cqx_+1Aw7z_p%
zXJ_K?U@%zyI~WZI-wn?mpO4NTpPmiRz8ehB`5zc`k+?}R%6|~~Zm@M)t1tH_5tIhM
zVM2o>9>eXZhtjnCIdBK=pyy-iksxK_(lhu64kPe*^MGkW;B_{^B*qNWUW_6<hQ{{P
zV~dpEOVcp$5Ra;NTct8|hr`~X%i;g3H242o6lR!qr2tI*fAIKpwf|pS3?KUcKIFzr
z$31}W!ExY4jDIE}hS$&E_5iT>;g4a8LW+9;fsbPru*E+RosXg4f9SG*1!?a83`c2*
z7^Wv)La>{pIF6>N8zi6d@U3)%zW<L#!}FE#e{?#!7(Dd<eaP3Z4g^z(69(>YQtRJ%
zshjtHaK3%(IgZn-n+Yfl@E3+-{)@UdKT<bHPHu<2n|~no$M8I(EQ#J>nq<Vozu;*Q
z2V%sJFhf3Kh^reE#|aaL0Odacyd-8M2}4Yr8IIkXY=S3Q5c-&i$V&@l;118+K@VWb
z+Mw=AGwsn7dpzbDNwRbdtGDIzdD=4H&tz2MN*GY~x_<T7fXX{*m=P3K35$y~h-X=d
zNO`#jK!3f2n>_!?lSz?>{T@L68X{Q-knf9vLE&2x#0-<?Nti`NfjICxP2#tR&Bx&K
zw{iV|rXgDJ7)6Mp41ST<p>{)>Ta=L?o;AeA5X-0=7g<}1Eq~!E<91Q<4DujLaa~py
zta9Wfu`Ck$;pwCQ5b-^E(tn4Mzvv%*%tI}uAb;+ul8`}ehbT<vXeevSo8t(L^Cx(N
zc=q<yZ>R5<E(0vvym^TP6xbYt3@eOZ{<CNZ@a*lY^7)i-b;^RGg-NOPq1x4z)b5<6
zd%)w(p8}tECM>g&w<YZ7?*z#d*gT*>a7r-6vFu*_GKwLY{Ej{5u0;JF6CMrFd6I=b
z?|*~0m@pvNOJ;HKuQF~5ED?!{A%THttuYEgn2E=LVt*y(2rYnMo+e~*Exz2YTnYUq
zAsB*qnv7x2SW3qyC$oSRn#D_^D2oHOI1x%Bm}D#=^u))vI6R@j%t6GP2Ml{GBlrZR
zfg@fd77fXb{O?Jwi|A6aYt2Q9PzEikhkvUH-ZW4im3+mj7WgGzbnjlgzl0(uvZiFE
zR6*CurKlfXnn66pL_RkqNhIRLv7aVE%)}2b3~<bVW|JsjycztFVaj;btw#G?XkVCM
z$Wk9M?5_rR6~l8B;qW=4c+YjkYlS+z60B;gKBlY&mc?7UQH%+Ss?GcP`xJXiJ%7!|
zG$6b$FvKwLPxX<akmerG#Uq&8RjZd*62F}DQVm#u!s3atN27-HG-V><UMrLJ*DZ%1
zQJo}``hv|7D-^;617!(+_s;>F^TJq*5|p|7;@p&L1CD6n<Q6+wd=n?1V`m!R(5GWy
zBwLNNo=d|k#E_)<JJfFEx_QHrtA9pWiz>@Qi=oDxY=pl2isKm{@<!+9ZE{uFTkDw$
z7>*h)>)NCg)p(?M-!;`&$qvV;N_IC|Rnl(Us^lOeSS6a4BV~P5tHidFcRA8kvZFDt
z665GsiEbRM<Uk{0CC1t>M#;Y?m-)P2)fP5Z+ENHN$DbEgJU9QhZFF48@_+XeIs(cG
zf*huzjEah+nDIV;Niq!L9)=f%!dy24mZh-cOAX6onqZz34SdW8KduL2FW}Q*6#Mce
zU3iu2vVa1PQnol&Cb1lSK$qj@k!@PB+@jfWrSd+-&7Y>oos|qU1W}k`^_z$gv{<=U
z&P@$ta5+mYW@q`(TMQBm-G5+6KF65Qd5}UfZ8PYy#`e2x1MsHF3n7>W`Jl&#o7l&`
zY__FMP|PA#qa2R2Xgx6prb*~y(r}}-ZPQ$n4y>;$6nAP9`g+{!hP9ZOTbR}&+>(iq
zOhjwk+`2B83|bgQOL^;;`bsQ9p&;ftWGD!!sJ$e{fOr)%X})0aGJisFL&+CKflE8*
z+1po8tc1B&vEw*b@g=`O8Oc1cq);}OX|i6+BC`Pz<_P84;C7PeFM#9-D0(lXh|L>T
zQCxtRidgX%6r~|PzKX?vOf=S)Ns?EQ%->gjhlf5nfp_KDt(XTuUYBxJPwMMwlKhPp
z<t59;t;PA8E1;%)uYWbXLJ+}YxavQ<ML~!rA-?J#!&Uz+NoE978pJbxfh*~&{x5h&
zkdOVVewAWlod2F8=FQ(=GQ+R&;t5Z?mPdK_JtK(W+2TpWgVk?`0cBhZJc&@suQw)f
zRSWzErK`!5Es(;8k9@Gc9lBMky#Adg@%XA=mCtb!@wT0^#eY@5F}<ZckFWYN*L_%e
z)A3bbWTMZz7fUADbbQsHEEuN8!()QeW3GgsRH<I|uZz~Ad&z{&F_G<(^042UvS^x`
zgov_Bf?_HSiJ)mRCdJl}SdXz7GWZ=}{DSD*m5EV?=Dm~KpIjBl#>$NZ6pL3?8-}u{
zms9D_b1ZF>EPwVf2^ZX6u2S>nD4t>81!-6yp&YoODn{vJ{$LClEsSiD-!ew7XQU>`
zqX9V!#VO;xM3qH3>mLI*gB>2@<_0FEXts47<<ZDV#ypEqEbJrkQL?-j`vM_|XQh@#
zlO&Vcu&Odct?=2!1aoaFx>5das)uUx_S4bhiyt>Frhj6v`#X*?LCp&s?MiGt#@ZxH
z6p33H|L&{`Bih$;YyXU>u%jo4Vjr?pSA;JU0zpg}iamS`!L&J%pw#@~0*0ewnB=w8
zu-yOUqucN*0fnEASMteclbINb{bq|(ide8BSdQEIdce{+R1D_Ddzku25VMOjRr?6y
zAj+aK41csOgAety23ro~%!zK_9Aqq&9fP={oe>m8hy`B$1%Db~Qtw8*6!Hg)$xvC`
zf1|m2wCGrGN#bW7pSvg1!Y20W`jk&(MbDE4AmA^&cFNTiF>Xf~#X&rymEkP(ntF1@
zANoAUV$cz5PI+8pX$ps6mLY;-hOy7JrA|HMaeve_H>#Ea44NWWFH#rtSIw6igqE>T
zFT=q|)5ywDiXbUs43l^a|MTIQ^WVt%*T+ZsKL*ZEpN_{Lf2jTZc=Yt&HlBAj82pti
zwbp#REKKL3H5`k<G?|J?`!T#kA;rh=PdO)56;$&aNs0q~9#ykFByNi|)c5nWH!YIp
z$$z30+wNN|bkww6Z3PO1*5x*}n_KU$mqaHPD^!l7PV)_l7f`8UVS2B1BFeblL>@^f
zEtmEvguxAl(iWEreu6zD<|<?oFoMXUHbnyu#V}DT?Tq4S7Q!QnF}QK!<Mol^NR9_+
z5`+O;aLw*xFNvpNkWZ(gG$9Pdnsww$p?~jY_zMIKB5o05v5ND^kLhqYI(?r_{3Jp_
z{4!!EM^7L9k)e<)O`p$@Uq<Z6!b%uk7`y1B53(bEeDuM||Mf$0>FDXBD_48}=m(y)
zTKE3=!KwPT`|*dPr?q=W8}@Yl;?KHC-54yl+#2u6ai@7{ss6Qp`IcgO*!^0Qrhj;1
z{Dr+M76zLqC}#6o6TgkEsJBhjMn_{otzDGq*A@mTO9;2}Yge*KsSS$k<zoYU{nqP!
z{ptXY1x0jd&gns##l-*Jc<G4%zPMg>RyZn42++X)4hI((EBxQt@O<>Z|LsF^{!hjJ
zt#E%bfWZB7sw#))-oAPvTF4URCx1YOd}yEyMd=vgEDTF}PX+DC54Xj_sRXWaXzq4&
zHXMw8a)xLyn*KC$l>i_>ib)hup7rM;3Zjy$%aOo-VG0%+Y+Q{5#ju0Iu%_+GM;VS$
z>@D)LSc~R!LT;9#Sth5yeqAc<`c3%ut(%m^T&s)JYudb~%pcJ2zl>Pw|9^6r7oE{j
zb-U&P!N7kHPe-E_{r~vv{9*ssUZgYqzpSoXjRV$7{ekL!pt_Az_jd4h)0e4cP)@h1
zvoj!WR}fqq@a+JwTjNA|6>8H}$nM~^od9bFNKFl<9Rx;eteqw_yK&)R70d1l%2s`2
zRsh*s;@HZioF)`|dk|ZZi+>GKFAZ|t1#qn{8#Qdb6>6;ot(Cb^L)HqCNKY}C@M^oS
z0((HKcMn!?hE*RFsy3{QtAT2}YTXA+y<?Qx8l<+ts1FQL8*1AYpx%<SwS%Ya8rY7(
z>78TK8$#2DinIZyx2Qz*_c9|Yt@(JR`gEoIaMdXytt`=|FWx(Wqko$|`zyd`6&9^{
ziKhBe0nuxp9h;5WH8P?@5L#)`Dj{fv;j%LTdMo@nN1Yp@-5h>y1f3gFut%R&m~%s<
zn}N?wkaI)iEwE=5;@lMLX4EsN0cS-b9W&1dAfD}cXZ<|EmUXrp_xH{@-*d{@j&U~H
ze;U5ou3q-QHn%35t$(;?L($kW&32`92%h=g)65;Q%x03=z%iRBW*x(9SN#X%mk&WN
zcgrqsM=rPKmTjnIBeUEMv22?3X=vpgvC3*vS<5NwDP=vQY$yaZpKRAPcf%&D$>jUP
zCGUeu-VKv%K_uTR9$DLjb!#gYB(j=AR#M1H23bKMce#Y4EPo0kcWg3vl`)$wIh_Te
zG7cIF<$*N5N7BrHy?gQOmp3om$nPW#1OGc3U96t}efIeL{DJ@4hkUO%vAd@`>bv*<
zKU}V!=>73g@!=+jW-gtJ1raw$PA15o;S(O-sRegx-?~xwl(I#LpG-r<9QsFw2tMk4
z|2;@3t#=2n@qYsD<bv`Y{DP+_3z_&=^$q&2cjs`C|1bV5{Y(7n-9a64yMsxRgm4Gf
z;+*4axT_t53`OWAO!lt$W_JhI{XTyJ?s`1C|8<KA34DGl&w1~%GV24migE4B?9=fz
zQ0&QN5n+D-!5J;rV8pCIls<*YqP8d!Cdo~f!ZeHJ!+(7*iJ~NSXPCXl3z2Z&g;$JQ
z9U+dy%sGEXOqB`75aL@L(s8dhbm7+|xsfxL>l?ht-vM72`4w6C8-?1D;Jwk(Q?oFc
zpwPX+i?xRm0x1#`)uw1pUHB)>*T1iu9<K*Js|U_sxhP7Rww(NwpEt##5KM5Ge0F=i
zA<Pkllz(6k`#AP6B)6ErNd7sMf6j_oc5sWsg)8SoC{0O%yg8sSOg_t3=CjY+z|T-v
z)DTNxj&8A>Li5W>JPl@<97m7g^E?Ro3@ivkm|$L$B6BPe3G?#i<%A;4_zW~mJQRit
zx7T|ijp^R?^>uG}R8pEgPQzrutJW<?MK=thfPYap!cjuXYJ?|nHu&k{&Ck72^>|)k
z=2+kfj0R^vzWKR#+9q*$BBq3Ie(s%BkF8djRWx~MI3JGQ{47f0(E9SPCWi6foh2+v
zw{!wvJpX^NI{sgb&K~&hy@-ncr_AZh3B(5Ve=&Nf|GkL1{^`l5Pc%j;ohR(mrxTC(
zpMUse(H>lW!#WLp{htrdPFMH;jUJyqeyIO_2(NCr;v|fwqQdzcdpL$WG1ay?{2$6K
z7fJ^J&_D&RIRb!9oB;qB9Rk1#X{_8rQZCC>`B~pe0^02)pxRObiftw0dc)QdF7@pt
zQcRmns&MAbCWR<Boh+~8G%Oq0Y(iO1MSry!rDakpn^Tt4xLm){>J8d#T3JrHzInxv
zbi-B_DRjjj0qC3+NZHn9ffOC7py!!wz9Q_LW!^Q(ya~sAK#Ezro~|O8Z7Op2^zu&G
zWlM6|%q<_3TGrNXvtxw%g9^NN-ARI!?p!5EF`WRZbeqtSolTr4Sd<|s9Vs*wNq>jC
zcnaC_G;XaUg{D{7)SZHDS?XLXG~}nfg9RxDHw%`z)wx`dqC8(%im8Q5F*{+9Vta;|
zl)X4)kg^ZA3{p0A&LHK$E*hj5Tb&f0y9O!kn!|ovH%QsJ0|zNB+&D<FbLJrB;4U4c
zShf~>_YP9F99E>*yLyn)uEFly?SF%mJve`mvat(@{BgU6VCN1(N(YTVcRFAp7A_*{
zuc)mx^$~tjGza-f>DYBdJy%_v4BDMD2`RecQZ=q6ssLNrd-~R)b~{mp*yNZ;HS5`_
zLkcOzIgG|Rg%pDcX|FUl-NU8Zv8C(QniFM<Eg`x+UR~_y>h&~P_<zj~Eq`=RK%3oO
zD|@>v;<ecGRc-m|A47e6SH8Qe+}x!)#kihc!=5ker<ON<**sR?5M~>`wo%OVh|O-X
z#?4~=m7QU7W7z7xFtIJHwku4xDXf33Z+Ni2Eld~u+m`c3druis+Sy?T@R}jzp6@Cv
z#MXm`6l;54>rF#SyL#M<XMYVT8~E4A^JwQ~LyBcl+I!rP(ymkw<9$QQz2CJ~NN1in
zq}cf5kYe=8A;s*QLyF!*hm>~B=b+v?q#VX)hm@{8cSzaRe@78ZYcC#B?0k9TVa*;r
zq;%!iLyGNUg4V}}l%09{kfNW!N-_BTs0Gvd|ER+0{eVcZEJEGPUw=wFg|RFDAo;6n
z=X7wd_T&|^ACDnYcI7ujik0^eDfep6ULjUp!fwUT%CATjT<u?^3ZwKhQUy`^8>xb5
zXR7;Hz%&-Jg;x?Oow@$Ax3Fz2H<K}D++w-zn|5_?VSagShhcubVV_~~M7i5gFq6Wr
zz41~gb`rINDA!NYhJT7QEWIf}1InR3O&dVvSpina4yA_$DXsi0aB23nAfsA#WgunM
z2LtH+Fc_j~^ojs$t`BOZ1bT-J`%15J(@<+&0He*?%*qMuo3@=+RsVq0J|MM!TBNoM
zW>&pQt0Q~NcK?nEp50PA?Ma=3(K#9er<uYrSKY2@n;jB1R)18DiKICoJ)@~jH4&>Z
zDw}E8Zdq9UcOESV+X)40F!9v{?2h@@tq2t(``R7(YAQby_1XdRYC*gja%rMnwV;B{
zmr6U%wat3i-Wb<?5w6?tt@nU#wORo(k*#eS!2YP#y)dmUiB@}_^<L1dR;{BQ$=V6R
z*oI<l(>V7+uz&7}U)_pcwW@e~a&_xUH?KikGONY~U;T2gVX=1ytZFwWM0QK5>RtM4
z2~|Cxy5U)ZW-_(?;eV<xshtz4hM9zcM%9{lwyJNh9IEb%<-r-$wgl>K_|yH;r<<^+
z8<D5&xYO3u>7R-@ZAF|ac~hG?TszjZjkR<j&h$?~nSZunOf9W!BVXF4?)Ju(Zb+84
z;7YBEuN_m`rX&x?lm1C)(oR`YTawg@BekPQ%?xRq=5la;^l<d(F4)m7$k7eCQG06C
zk{Rui7`2<g8)?y<vZ7{E)QS_eqeN{OQL92T@u6*$!7kZQ6B&BnxX}Gkp}S;4t%=Zk
z$b(ume}9{GxE3U+nFBRaphgB%OMvcnInYp`mfUA2&d_Y_U$cFsH=2|Mx<}IU(5G|m
zUUcWbE*<&0MH;5_f6q=Iublt;`1IlY*Zm010*1#Rd_Kq_n|B5WTzBmd=$<(1p5HEy
zU>&$am)oHzO-oR9=ngO3K~FRx8CSq$0u6|?=sS3bQcPIc3mqBmeL+!6D7F@j1$y0+
o8i5sY)?7Z+G=VwcLs!p(JjjDQ$j;<{0{{U3|9VPT{Q$-Q06};!)&Kwi

delta 5700
zcmV-K7Q5-%EZi)ROMjEDNlUWgw3^9e(=@p^lV&%Q`1Xg5voS<M5^KH+fKGJd{O>ye
z_>x3CC{dEz_32C<kstu#ac}^BfP*|Q$ztXtDJF;|#PNtvPoFOkVeS$|;ddR#U@#b*
zkH_NgU@%z!I~WZI-wnr)$HVdCv$ON@cZ1=h@$k`iFz6z2lYeBCA@bc|=d{*e?oT2p
z4SvIf21z`Dn^6y?Y58;D4%|V{$J8T1%EYB-@DChD;PK`GvxLCwY>G*Y8K%7$MR)>@
z?WxC>DZiJdVc;PiRqv)sW#|rvy<?Zd|5a)3|2HViFzreKnEL<V@!5L+KR+Mc_y0r4
zwU<tM0N;b-z<-MvO+yT?pTF$^VDZDBzzl^H_W%MP$1GsWe;~S;K)-+AW&aA&-2WMl
z(hxCBPrZa-H%W0E%~Cf=KIP$C=>~oOAB~2O*2e$Q+30+D-~SIGU%xsK%pgt}xW7rQ
zf9<7i-uuD%_O0hQPOokzpftc=7>@Zb>R$gy-5@!=8GrV!gV>+I^Ng}2dWUI}5fA@@
zXF(i@5kJBV`G_H|ZcrR2Oc(-`{{--on2{t5F>&TNcCWK3o@PPlV<I9iEtG*f9J_-a
zz>2j&-L+=gqbc@y%yW`t=>*nq%jfg7Wxk)usKk{ppzL-1>aPKnchWE;D6A3|7ikdB
zvk;N;a(@qidI>jq{*xz@A`kmLfc!N?vJN2M7X^dDw<L%eCeM>Fi;4nq;CGtDZxLHe
zz~yh_`T<QtwB#|05JegMBCkX3hBUV*BSAcGh>anZQ8zBKwh~+Z!d1rYqU0ImL000r
zs4iIL$V*~bB=p162mc}Bd-A0J4kLfrfA}#EwSSU=xTi`&2DurcFkPUbtSN7SBQ(jM
z;0@y0+gHDxy<fQuuxj(>B@$3z3k))>Fn;;Zq9MSux39|QQ^M6L3yKydrPhaPSJzUz
zbyn^Hk2ik`eBPO`%tqdpu%EvZBr{-(fC9lO!4$``d-2OChGhCX_L#dC^?OWsG(Z<g
z7JvG@58hzHfM73~$HBkKxGAtiBr1jk2BNjbC<I|9o&bvdwU{Hc1cG^*kj1t5a=UUZ
z^qYiW2;x~XfdykJot&P|16F7jFNvZo4%qTkD2ZU2v4qf5AK&2clm>GL5pNMN?6HjC
zQ<Mgdc#&8%BscQEC%G=7E6Hv&7b!v+w121`t|oZXKzUU16{}j{mw3^=d-47Pik!%r
zl9f^g-6)r$et2mH@eC9B+>9iVh!e+tnglTuKfEx&F$0=Sqk!>d@JEIz<5jmF?Q@}h
zVTvJ3eZ;W89^h3B&ryWK=ZNA1*A=f7>hMais;&B%vL09#Z|z1gCMc>l@8|DR?0>EF
zG#}G|@V>wh!@NJ$M~Xt4dpsA9U~X5fUtUZ6V!=x_U;zq?C(0g;8q(90iHLinOg3M)
z9DYP~l1S<cwm_^<2vZD{CH&n#2W-I$V<SpX=I)DgU9Jr{qJ@(i>}2tEoP3U*S%5>I
zPJoeYJ<@tE4X+SGlIHJFyOHbWEq_a{8f7i2EDtS)8gsG{`tmD|=X}T;J$lq8SCzfB
znW=!`sNu4%O-fOXM~e5|P<@r`ag3^Df1_0;?Z&N2jxvH(qG>r&Hb=EeY%6)6BV8qX
z8uKbKj((Ns#=%OCG$K}Fto>q?{Cjed&+AofVQZx=g>ZBHd11wK^MBVy$A6V9e?Ork
zpqwDcVJga~s7Q(#@ADTV!yxWqcu^?KO*3Fs3Ol~kuso(I=1I}O$9(YPdLZ@!J{?A}
zFJIDySGg_=DBvh%%M)c1tI-E^HEtf+wiU}Qnmt!4?^E3TX^Pxg%RoaAg(+6Qi3mZ<
zwR`2<)G!8@v(#dCmJhwfAb-KoHHPGKj0s%?DI~KtgDz`qzpFL?Z<@Rif?1FcdVIKv
zeeBC-TiOK0EK)Vf;W&#n6LVmeggzz>H(J{^%{A%3=DI?0r#7Ll$GvG-i;1~~X)VI7
zm<Y*Kw8rhN>vGAUg<-Ukw|=Rw#3B?5VxB{Wf{=>ZOJWR&S22_33x5VLBLp{;d{Gp*
zv~!-leFeozn0pyJj&m7b@Eeqo%o9rrWpkM&o3$)58xUcRP@WBLCyD+7NREJ__d<%;
zqG1)q1$e256@Nid8sd}7Sp3ICV||$<c@@e0edTv}=+jepSB~9^c>v^fDOdHRzMdt?
z-)K=@vTWR1oUge8YJbZ2M#C!v5j=s*{<9ktglHP#%l-*m_TQ3ZPB5iGJm(j<lD_Q!
zg69PJ*uU&oDK^IW?<r#5;teKq{2DKx@U&}rly~1Vf*77JpF})Z{dO2o#<jqc2&Mdb
zV-lCOz;95xo=n*SDSY_I2kV=mTeZro-)Rz0F8fvaoFox%+kYurUiKT)Tgmg}vM+Pp
zhm|*-T=qpK`n-FwWSY$;m;LFIVR|w=AvitZO87~Y>Sh0`Xf3*zOxOYw*)Ay$`>iR9
zrm0DYD7zpirqYlInkHjXYz>Lc7>gl;-vP!ih|XP^7-eYQJGuSIRe@}*+(<yNcvZDw
zD0_N2mHxcI(tkF|Vjq)m$?fGTHE)69Ird$Uh6NJJfg7q~ls@4P#*op%$QJo6W8`{9
zYJxl(kh4&nGTuv6S(LN>32-ym;W2J+U{Z?aJJ(SjjhtjGvIxb(J`x`#%X_ge5Q2DK
zYH2i0GN}!#Dl^mypIuBb*QTNy<?p6?s5Wmu8$CY%aev!lDh9j1;}{dvyui_}#5QBB
zO|nFhxP|fW&Z{t@eXX|k&xi^;dWtCaAxm{d_%b07#FU}f!zU2TniC01%^xmdI68r8
zUP}$j{a-%14X+YV_~~RVpL{l%iJ{nUwm7AT1uKH(xSg*Dtc*j&U|zh3sgDFPJ0Gjs
zM-T^57Jp4(plum^sGm33av*0;bob^UW2x*I#1-wFpeRBt@bWMCvjCHNH{zv`KUhqL
z%HsYT&DEnt$9hW=KlAw9J((3Yu~*lpd?G7)o-_aff8n)LuC9o2JHjXq;yJAhXQ9{B
zlPmtv=LHsnj#zWb<030lI0W+y5fn3weXcEa>VF}Rqo%o0wG3d;6uEklx|qLezSJPJ
zjD>m`4n~?rR)$gpNfBe1#1r_R56_(cM$W%JKFI$uaDMu9GWqyJ?dQjbPycP}d1r&c
zU&%^q&Bx2abS_%Mi5N_inV7Vnz)KWTd;<TJb5d17HP4ZxIMC-&HQPhtwn#&LKTmtx
zB7bR~EK0HMzQsaEP21I0pg?F{Zd1Ft_3nB}bZW6e<v8jz-=KI2l`0md_eLk8jO$J0
zk%ZE6X^%n}Tw^G0ajD>^*h6BjLZ$&Dh%9SUH1JRiQ?=60D4t~@JfIkZ8z(;A94Q{k
z@c>POFknlr*?sIK@hlAT=~R>^grQioj(>b1^xYhPfq+58En+NIaUS?F9S%ol@3X0&
zL@0<~M(p(A(+7WKDCA1h=QHG&5qoH1B@EAvUG%{R*%3cJ_~7LK`k}b=@acm~S9|~A
z4?JtN?)~wDQ}u24;|~v?*6uyrvZw18e>P3(#$dVS)_6~jJIzZ=^{@S_w-nRE?tj;s
zG{qC+FYH~hFxWgnF`L(#_-$-Oy=|g4IvNXV<DyKzwlGLpLb#P*yOK>yZBS${9~<E7
zw_fk-R|jw`D57I?PWRF*CjRf*OHT#x#r3MQ#!*>9fCm0|I5<CF<NwCPM`!o^-ytOD
z|5WVX8uupy2;48Hs&aVl?W-4}g@3G2egb63hX%?}lujVd!my<GRM4LMa9b>#O5iGo
z=59vg;b8QWGem>Y?5B~d1ONe2Orn7DtUnJ?5S3hAjs*4#Q?SrrlWHU=h8+}!HEmZu
z%5aQgZ<&|HMl_!ja=jAGDmnf2>q=?YZ^E~4-J~q$T3w`G)8;j0evf|tWq-s{|ChtO
z=!}l4+cgge2L5|^HX5zz|HtD;_xryNBAw~~RdwBJ9I#gE_f+>i)orA@cZ0W^zDzZP
za=KNWy#aCig5cVKZ%2UL8Yjx@P@Aqo_6M)+1z0mcYHBd;C@@-M?KGj;jSCO!Saw%X
zw(1+R0?6JG$5t-oG@;nLgMZkHTx^MYX^`tKfNOQxsA21!P-`t{t;~%YvR05pdWyk>
zSKECRH~?C`f3SKxtoo=>wP9sk4OH7z>mgw3J)_jtAhiufePoE*P}{Zu^^T;i9XxH<
z!1fGI?;V@o5}Gztqzy2=LnW%eml;uM&BrU%rz_=$t4<MVWr;R@@qgY69NqNUUjas|
zuxQ0gG}V_1h~D_@*lf&hkP#h%&`OI|2|+6im%RbdJK@hc>f8|R_V9Bf=-iNkJ^HM|
zoEswD4t#EcoEsu<fjz4b=cZV<qn<$xI4ctAn0Y<|@odjK>*oo!th3#?e{jzEj#JKd
zjI+`H)9}r9^>P5Vxqmg;Y{fMjipG{{wkxG$@XU9fX6}e(Hj~T-j@d*p>lkLc>OUgC
zd<=TITXuOja=A6PY(p&@ndNSXWz(cjLo4rzRaTSAT25I{DeD<!Lm{a7WV^1pA2wM{
zCf^+{`4Cj{ewbtnBKc17$l4~XTU)Upk<}csl0sH8$O;0v%YP*tWl<QpW0S$FjM;3-
z=`0A9anMjG_oVS1l4kzv-HT_xym{e9ekW-d_}|g!eEt0I@#9D5_x#r(<a@=5-96n=
z-@X6;;bQ$n?~f0P4>v(Hcj-bbh`2#=Iz|2*pYrfdEx1$r){Vlalr2O2WELXk&_6On
z@WbBs--CqGdVja@8ZY5iE-2r^FL;Kskcod)-=J@Mw+<Ki|KiWezr?TJEz}{mTbL$E
z2)A%0&N;q<+uAY6P=sE=WN(XacDHcV@AD_%w#T#kUpJVLz~{H}ocAs&vp$fk7+1c`
zKAl_v#hzRi5%vcVoY8U(M$8IC=~I|4Yl|Xbl3Zsg%zv_2KHT?`C`w{?j@fIx6bbiT
zc*VHY5#mV9obzYIRGDB5A-=&Oo%DJ`7k*8WYdK@Ny2i`=9q?6=Uy+5sQK%gW-W#nv
zH4l?13f*hG+;}J<kRmZrZHng1g@4j~{rjrv@p|BKJ#hZYMN!JM<>aUQyeSriV2Z=!
zv)k(pVSj-rqy&4|$FYYYxxoZR^3R$4GcIP?!3_?VuACF0G$jf07J$Mq`7B?V&pvMg
zKSN<rLo9&>y1{Y^%`YeMESP6<96f>0iy-7PupkU!ig`_n%&|ly%*&gX6N)h7Gte;c
zP#7-VUhjo8rh8XcSH0oGlG5~X8YW9#wQe~ox_@C11&q28juKK<BRqle;HUF9Klet}
z<9UUdV}U0y8jOE@^K<X4P2%uGObOro+#6Sqtyh^<G<j%vG#tJ8S(L)D_2pkp4CB8$
zPgs=h=mfxc{{LWo{68O!@A>b8h>HKG%<0St#1{2`KDw{}gNVBR>FK9WG)5_1B<$0t
zQ-6>6pZI0b9$bFIIt_jOKN^nD*7yI79*+n2^?wNA)h$<?gwa$~IG<w=CvYpK+BS#(
zL%HQb=>Py4sNfAp0I-cS005&y09Yf9m0L*4Wtl2Jn_EdhyPX77TS`E&twdaJ*jmD+
zzP&_>X_HA6&b-;A5ap(m)peYPWh0wSD1WP|s5YatOloa&%4!-Hn>Sj$L7Po0t0~tv
zuNabU*vcY>uK6PXowEWdySglpq9YabJhRPLguS!O`zD#U;h2v|F>BY;RRpt5Med(o
z-YdIoNiLhY<)c!|+S+Y)j8K12f%k4YNs!W=s{|>g6Cjmt6B@F!jq?PHG6ba~g@2|Z
z>2McMAv>PNt#zc(^a|U$Q?M;dooj`L{IqwlAjRNj!7{fxmkUyq=L<_QwQwnBCk#?-
z&k&Px5Qhv>4&jzT%C^oKq#W5rgA`+{lcICiAf;V%IE?ECDSLO|Af<&H2Pt;W9HboG
zrGpg9)?)A8LCTK9iWGZS4^rAS*nhpdeUNeh=MPf0b^(z;Zr2d(+(Ag`pb_X!2Q0+G
zMMV7-wY8=`!cU6kAU`P`yN;;ms*96ByK^QXMR#1P#<fHhU?+P|-#XN8C#n$J9P_AV
zJv((sA;ma{(Kx4&VlW}?mFBj4xO6+VblqBWqHM7xM7PJQiyd9Po+b<buYcL0h3*Mx
zv)gNJZ<j^97JI&`Enoc;sBiDecXySWyHuwb*VAj*^JV?i>c%gd$LbrxY{S<!ikTj<
z*)7(%S**XdGfZv_Ti+KZwuRMph3Phh^{?~|4>q@j>4JaTasFuUDMLy-JM0KvGo;+{
zU1f#XdeD$!ZO?1HX-H{TkADa8tRZC!{~CE7?YwMAu`Eh^j~i0jmFjW4Z%DcGyVeTn
z%oB$c8-E;9j9xjUn0<3d(R=8S(ysX&)mw*@<M`~5(zWLfDZBdbC}L^t#Y2jnFONK|
z*`tS)uKapPv0Y5i`uLEtH%}i@^b=Sq2EQM*U|RnlRXDvL5Gj^LsDGRJOKGPt_T?WW
ze|7Dg4(`;Ryh0A+F+|F~{Dw%e@*X1PPVLz%#Hvf!tr%MQ6{&)&{fks#lzv94AWDBD
zRS@k=^$-h~#zMC6N+P8**MIgFwvFXxGRBNsEH{1AuJ0|(FK_HH%&#}>Gc2AccN+?3
zQrNZEUJAudqIMAF=6^}rP?3hEHw9=wIn<|V1E@SJz#7@1^speMm7fJJ&At|7RI9EG
zq^$d30KFduLo|(E5n#jhL9LWP@37%e=~ZqTYOM=kv|XE7JAr-Mw$rNW?~&Sjr1npX
z)ONwls#j@sWRKbI-!s9pUuvg4sdF?sM`PeLQ#j_T+c#~qM}NY`imEY@G)JUoG_|QF
zVl_r(GY#7<3#<Rmqvc>bp<oRrzM6pDGyl31p<-lTyCYvs<!7Q^J78Wdh*v`{O|+{P
zRIvF{X~(&?Sr0oH<9aB<br-(%4$!SuD?lc)wM_#!9MyUdrnM!}YR|LY37XZab+jW{
zJ3$!RP^@hl=YK&6)&udYJJG9F6>m?j?p*2SHE2s_)wtlRU+y(5_U?gI?dF8YZYfp0
zOMfk)s^?R;JWJ3_rnW!)PxU3Wb0XC+lQ7VzS`*J!^&ON$)qSx%I)mDlK-~|2dRY2&
z8}@W7^0Xay+L}83Q!%Hlh*KqRYBPsx$C|dWmX5@k{(mVb(>9E$rIl^uOWV}l!PwF*
z$<h{Fsa5f{V@lhU<negYKM76RDNAZgl3H=3b`+_ZA#KxKj?RxBj~?9zJK6;~x+OPi
zPmNkKqg@iCb`y9bExK1$)J%$6aiVsVs0|}(RcIzYw2d;@CmU)aL+=_FdN?X{pG>GV
z5qbxCP=AZ&Z?g{9f&?{lphgPR$bf1I(ETn48Vb~s`|QLSnyvk7wy*R?ld?b$NO~Uo
zbk6;Y?)=x4BVTt&!*u@d`0Vl8`M;0P?$3WcjL<A#cml%bgB-GXXK=uEHx7aBiL>tc
z?eYlLfje}$9g5Pl1XYLb@Z25rL=%#61xzN;fIUcyj)y44gq6L}k>TDK6t#q6YtdMs
q*FC8bSP^H<<wH#qm=ivB_1w$7+{?Y}P5w6k0RR7E!zs-G#sB~w@*lzg

diff --git a/charts/account-operator/charts/common-0.2.8.tgz b/charts/account-operator/charts/common-0.2.8.tgz
deleted file mode 100644
index c0a4dc86d5dda55290dd155603e737f63c65a6f6..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 4413
zcmV-D5yI{tiwG0|00000|0w_~VMtOiV@ORlOnEsqVl!4SWK%V1T2nbTPgYhoO;>Dc
zVQyr3R8em|NM&qo0PH+zbK5$S`OII@%a^USUPUx@*v_yjwdEvwiRbxR+ey{z)|L%Z
zEeT_a-~&J>n%Mt+3kNBXq9kV`J3BMR2U{f22O8at#=(x+bjs50cN4;8FeB6C#pX*G
zhT(3%um6W(SpOe(c6MKM`g=Rwes6ED(|r+ky8XSq7Z5%IFAF6XlJFPd57Vl5?jNL(
zjDAKgC`%)_?RrBLF{hc-&-?HZlPSbXHy~!IBs8Vz7&ztvLE<z^h(zI~WQq|OP4eU{
z!w3?3%?Y1*w*~Gn=mxL7pWWN%QZLs2Z%LA)cq9j~#{PS~y>8w9_xj<p{Xaz+;)vvl
z6p`lv`~vMZ2;{dkM#vbK9_W7&ybfQ7szr=k9+8xckw+eY1(9q#P7ovmOv!bE+e0eU
zf8D%2HSKkCQ$LJgL=u4|O*$oGJk68j9Al0Wr~o-ZP>u!INdFe5Mox%?2}_2i#gN4}
z$bsXS3dv^>a~xtSDM^F}b+i%qV=5>4wZBOClqEEt6@)YMBpE1A_ho`9WO<S(=cgeA
zj2H)!B*r;bXc<fq9E^^cJmn}bm5SaFvxLp2m`Wo#j)LVpMqwT;LvfY^Nry1SDdRIp
z=#)xBO?S7%VPQ;tfdLeF1b!zBr+)d)po+lX>2!~%zk(XaKXMeS=oKyM6#LBt!-Afs
zHYH!rb3R7>rg(^8r_$n6N^S{Fl$sRnoL3Qq^VW0jKuAs`j%T{Ec!=PP=|TIH4T;1?
zK#sRm%}_9*LY5M@17xZ`nwmpZ5kXIl<pfD0CyoV}7lq9@R?}H*gPgLVX{CRjW6aW_
zh@j*2jUyS-6or6{vulKma56=STv*<0bukbbk&_7gZB;S*TQL?irOFoGV?t&nnVkY;
zIrW6z;&S3eZJoC1U`c#LXp(chm~a%zVk2;bp}ellvt|Oea&_Mp(f72Anxf=17S7<<
zHw~ks0jQ9aJ;a;ohD~lvy&4mVU&yRt%&z~k^|soCOvO77U^FHVVFACYQB#^r68P=I
zK8%paoTFIcT?NKDr*ig=r4qkNheR%r105<FJWn-?HpH{8n&;`h_#}`k)d(Hs7;~0q
z>p?%LW@=De*pYd?5_(jCb`_`xfL|r@lvpn=9wsLP(l*mZO+1q4_#BJsV&lIunBTsf
zJI9ZhWXMGzvmXlzSI2*y{%&Wd7XR&ap5wo#Dc`=S>2O3-1mEaFFjs)LM9^6HaDVTW
zbE*fx-B~rN&F0^}0Zrp1AI=euQT~pz&uWR`!`6_-5`6t6d<e`B@NaPDgFmMo6e#_c
zqTdt>Y?73NxFBd&vKu2(NYJ2f4lXuEtO>m#EHJ@XG9A88iHs+Q<Qfy}R7sX;CW13e
zkO&Np)eLrj?<qCGbXfeXX-vk3j;ffstqF^ckt6U`onbxDuY%Mxh!!d&8N>a(?==Xf
zjGui73||XP)I2}0UeyB!nI0S`G<QR69qev!kSv+N&<NrzceLF`(T_*YP$(!?L;J_-
zX+h=5`dSind%I4Zwc6a@d-|6WNZUqi6DczzpCV*A)v@G{F|NqWg^_V4S<I3MF5aDb
z(1cqN6-Oql{ivhvWh7c~2PsX}q8PeP*YEGWrmjnjCn=3dav(&G+(<#Sds(l6=nW)P
z$f5x!=@{W9)wQqSWz5nM9jjJ_MN6IwiNgZk!qHLDHlX67N@O|lH_BD15nQY)(d9g;
z^tbx!uZ*VPzw#R}td-KWa(09CmU5OVb<<KRROImF!{y=N^We|}(A#QSJGKfbBy8LY
z61>F(?!fN8fKSsAt6(`Bd^k8cuAnF|a2%@ztJ8RJ{Q2PQ<oIZCe9;Jjb5>oj^TF}O
z*<UW#K?_VJpH+~|IbTEK;AsED;PPVs!yNOX_b;4$73g^XXs`;(&Kdr4^{iXXqH+hW
z7B=ZY!P3Rx-N)mDcl(Ez2j}OX2509LNv%?$l0uCcBh@yhx0a29)cb?8!Mlrt&x7;J
z{ZAJkPtFehd;j9#<oI%My#Mxa@V+XOtx~aulw&OEEs9n^ayem~{*6e=(pF#>KF+Y|
z1!5_^<*ra``nlN=tmx<I$=OBo=qP9QP|Sa3*A=V>=NAVjm;d$Y;No)s^k9x(x!q`c
zyVKnZ!XOMfQD-OYhHEIqEHR<ZGE04Ta(Fm+cX4udc|JJ%eDJQWa}6O(P=6;f660#5
zp9g2>3$|R~I4ky_?%<D{$t9=;$L~*14r=zfMbcp@btW;XJh<H-W{jq?<vN^%#Uz<9
zA)|h;v*)j$6wT(&GEsgU>>plyyj;|ZQaufP%c#ekkzVihpB|ts26{goo)sHk{*suF
zWypzS{G$soGY}651XqFI-+RT@*C}V$dg-Gy^8?zA6|+(GW3hngX;2Uf6iz2L*g&*l
zDY!w$;$GTjJ5k49(5-DjZl+%@PP^tY`-zV}XqL`D^q3WW_{l?7Zg4;Ppp}%KX4o3H
z<Tu=r1{zO1e5;+TL_Vdd4o*IB660wF0kn;0FV_vLT02uoCtOdtc1l;$`T-%-Q9hvm
zP0P2oGn?823va{AOpCUnj@89xxy;o}we5k)Mww_Zi7F3;=#)SjS6?MNLG5(I2(jVF
zLs`a2n#|4^lfTgf#Y{+?+H(MVTye}&Rb9Rm7{_d?=8O?d>@KI-5j@LNNvHVUsGU31
zjqGM@_;5ylh!cBqzaPgePvvp34Obs5OeK{wy?(MG5y>T+Dwy*Mh6{FssYa1930wHb
zJen(bZw1TX%o3w+3{3(O8OGlyA#*DAV|rM_9h8X6{V?Yc>k&w4%;jAEID|$nl{KSK
zF2xI<s29asl{I(EF4c8y(;D6oF-uF+$XqPk&oX<<tid_1Wy)yk3a(OTm%4G2U>RRa
zwzt=Dv~=2V`3>xbc5@po==yr(C!GH*p8py5pd|Cd2Y<G#yZ_nW?bOcyc6R#x=kvd(
zC=DuJnI9ahv-7T~7*FF#QO0R1N8tava#2p>J2j=HG3@r5Y;q3O)_@hvYtYzup%Oc|
zUE>y4wNn*7E991w_}K%t;j(D|X1+OO>?Y4P;{n##|8B2eKmXqicc0JypQL>Iw*4!3
z0KesFY;Juoh8-Tjd-q<rjzG`UVgheb05SW0Fyd?q&P8Ilo<Tgp_=cuqxWSnKnu45A
z0gMk-0H^VE0yw!v&gl?UqgT)k;6uW$Nn##*0cg`#Pw=WAfQ@$5bD+4$c`AUUfYVIQ
zKuE4{X^tReDFS|_LI$1(a9Un5GZAzff*YJg@H@`*ZURUKiBbBZ-b4}+*dU8t{}p2y
zc)xBpuj(p+T3g3;`e@<?XQzrl^hT3(tBkaqLo(yJY%Q~LQ7lGp9B)+!%%3B7kdC$V
zYCz^?pgdg@j9o+5fXWLY=8o_pbfq5((sz4KN1)aW^#Eu>#4!qq!{1fVT8n54k(h|q
z6+x>7zFHCa#RiQ-dGV}gjM5Nk4xCqzfs%hcIc=a5<$ye97v@AZ-vK-1kI8;PV)M+;
zRr@jdcc|35&~74Dv6CXSsI+O<)*_9kA{8+d5Zk|c7s|_ytV=geSO8b6LqTsbnJKvv
zNHwf>tlCcs_(J7`ra)jyvcUT!$dVgfE9GBXl-}U1qx@c1{pp#tsCC<Bivt+9=aF02
zj3r3YmU6PLNTwvKJIO`oDzb#iLn<WrfxqBtSuV3&s&<B!<G%D{Az|x=ro#gP{*+|C
zrrD|}ipAg}Sk%-6Q%9LQ%?Kt$C{L@qwKbw#NC&2d*F_NLoMT#e=_+7V&p1xa$6CLu
zc{h3k9No5e_WDEMSHV*JDvyk;$0!YhE>*WN9YIxK1+Z;X@AUWCaDmL4SEWC#3LmbN
zR*lr$)+&a#pdkx}w`8ubIESUS$ICEDPS6HQL{^ROp;ouXBYltEUAWBXPi^Mx=xB&>
z@Y6g=d^OJclNj}O$WUlov2oSrtn|A~aYSgcL@H&pHqC{EYcx{zzu#KvXtkMEG_Ew3
zCDy!5Q>}=XE9g^ufLgCzdKJdMQ#H4myh-ctGVZk^TinL`XIryxvMjFuYah*RU<+W~
z{$ICW-~Zd)={&FhpQNlhBQ*-(mp8ZP?<#j<H*|bzskLewZa-T<|Kz2?{)MD$U~UXP
z$^Kv14HxV`>~@~*|0zn7{W}V<kqZ(EUvUTZ*}ngOl|}oPSz<SFH+1~B&i*^SonHO?
zuit;p|MDb7@BiP@X#@f#jA(*#mf;(<dLr=zBe1*O+rN5em=2N8_xp7!hVoFb&>+Z=
zPe^9=l0d{P!(s_(9|UA3D?+i>ZSpU3E##W44_jco%&qY`<#lr+CxK*voS=E7P}n;p
zFQK*Mmhgtq`?^a$yd+s>Xe~P&SR`0%8O%4&mE_f;*PLPa5SW@f(BCriS@B|PUcvrC
zrb!DL4r%>w-+b7T?9YOw7SP$5q$3E-a8wpoGD~19CQ?DS%?Q2>&M+a8-r~7#-@d;u
zHa|@(v&!;Yur)<K#$qz4K>3zh3j!;>`Yx%noKs9#0!8cQ<z0PoY+#zNb3D&9&Bglv
zV1mh%j#I{Q^EB4Qe_>}K|IhAT@7e!9MUg0ETPLyk*_=F=pHZy+pAGik9}R-(@G)qt
zyZ_M*7wkXmKF5DgQhq7&_IVG@_UHZE|6I5^{{DAsB4s9`?QJ?82Vz1o8H#|i?Q1d|
z<F;zswoThK9Wg%DSNTcupF++Od^1XjY>Pi~!m;K3@{8TS_wMw~j5|>9a97^?xO1<f
zz@2y3R>k}+{#AbIC$IcUKm<+-Gv~v|YsM0|gDZVvbfrV92jnz^3g(976>tYse=mEr
zqma&DFNbq7QOu!33tg#Pf}{SOKit`?D+<v!KhAPLGAY7d`Szpu$mRySS7aWVg6shd
zlnKR}Sm@U{2$wLhA}iSn78dhg%%$18(w~j2NdmSMd6CHj?uzS1cW~uba*g>l3Ud$_
zXDzW&gE~r{uhzzTqN6H-(U|;QI=(c`R26;gGr!s>FML53bzb@U8>?uZD@+gg(sW~u
z<g(iLKXy<%+D0l#)|$c12dEb6b@;mD!s*HesChoNYA2gMwTgD;{j@pDUisCJq@qr!
zd%ir)TO$`m*0gnk?u82+XmZQ4u2qTElOk5s+)Zn!wR}S<6qm4I6GB#4ut^*%#5b5Y
zvc`$Kd-+{Pq#>J-*|cxw<AiF@OpWeZL-M#PGWT<?ib9*o!by5pg==o_rv0q8U-DJS
z97Q(_HHtOK-Bx3re-z{RX^VJe#<>Te{UlVgxuY;xS7pG1J5R+T_M)X49vhZ;<;@9u
zofYA#%%OUvl+9eZA}L&>iJgY#W-OBv<b|?d&mb2HtwLa~ozCx!H0`kma3FzBvjmk_
z76lAbEO1278AU|od7S_b8M`s&b#;TY;<D&f!LMfFKZJW#*XvfG>}Am#oGkz`uH1&2
z(wflp0{A5CU6-pSaJO;aZCt-<s)3z*#j26iW_67T`x1Cw2PQ;sCC18fV+3}K9J=OT
z&;08HN0FJd7|AREeK&_>8D}J(DCfhzm@d<FNN?#dC#5@*3?}3jVM<dvRj+kYnVjq3
z^%Z=X&;&t9nj~<IY9uvtl0k8o)OD{q+d?u6Ja6!os6q6uuCBaJtK4Q>pQfq2B>e{Z
z;h%Po-g@0RxE-+dSl|tG!~W}|w_fjih{GG`gx&tpTdzL{s}I?O&=eo*s(ACQmcq|o
z0sU*2`uaZ@GdbPRxld8n?*D~hZT;Wtb#|ZE|Ig*QJeTM4nC1Th00960gXS^b0A>IH
DRyLg#

diff --git a/charts/account-operator/charts/common-0.2.9.tgz b/charts/account-operator/charts/common-0.2.9.tgz
new file mode 100644
index 0000000000000000000000000000000000000000..cb933217a29756fafebd8c530fd3cf788359a1fc
GIT binary patch
literal 4414
zcmV-E5y9>siwG0|00000|0w_~VMtOiV@ORlOnEsqVl!4SWK%V1T2nbTPgYhoO;>Dc
zVQyr3R8em|NM&qo0PH+#bK5wQ^O?V*kCUsjrXrep*vYWUb>$?Q#5;bS?WAh&>dJ<x
zmV`A$Z~)MWHuitN!h;k@QIfNfo!vR(gDn#12O8at#)BQR>6E40ZzqJyU`D3NPn$1c
z7>2w3zWyJEVf}yD+1dT6(|@(oeHDhg>V2o%-|hbd;Un;}P;wy&|0(=#TJ_HTixiU4
zPsjyjX#}@jZ-^r1G?V&yA3k6*g;?nZ#4MGBrZgP`$6O#toMs7;D7=(RF#@AWo}6VE
zK|-%N;WO{Hz#RtN;8*WQ_x8Eei?#n-lH@2J$pNgf|6cD^r*8kRy3h9iBxQ&rk|$C`
zo(J$VwA&z%-_jT%V_bTm|3&aRd>yJ5F>-lCQZhy!c>oqfvhg@UkPI*-*9mS9sZjrQ
z^Y+xV*Ue4+FoF?D1eP@El#KB-Pm*(tIZB`c<OD%E7GNX&TbLR-ArdAm8JZSD7T+KT
zj$<k$pFzxVh^eF`5gydhM&OUBoaER3BH>e((0Eo5&dif!pgi5@38s+cNur#eh7d4f
z97vKF=UAa-Fhy`MI%e{eqrg-udPB?-Hk)E9jpR5Amh%{ed9)10Sq>x}!W5^B&mf^w
zDh)N=-4cg|G4%xoP~Z{xoiLpG<vW8a0)MB|J)-^!Y8?N_QLLg@w5U_;HxmpCdYaml
zd^ykg81<XtA%dMsi;pR}B{WfLQnYhkMG($g&$$C3IgvP?>B{0Ef-|NE?PE415*q<I
z-cmI~!GsD~O56^Rsrq1Q4pl`2JvEjSB#E3j7GPc!Hse@LXR!@(%7&(u{&|iuONSzY
zj?*`eWJpsK0y5675i-Kb6eV(Dd9&5UKx9NtBJj6W#q96JSkROzTX=^FnU!RA3XtX0
z6MBowi5InX+NOgg@e!d(&hcWxQ7DUzz!8S>x-!q23E0ZjeOpA|(=KX?lG9i?gJa(`
zjE)ANLQ?h+Z>Aeo-I(OL(W^0$_?gTqw(PnuTW_mP#8kZV07hf-5DxH*8Z@Q2B!S=F
z@52a*%sGk%t~^jaGv`#!-m+BU7wJ&Q1#+N6MS|z4=FkRs)=~33-4`DPa-|rdqZ(t*
z@@zfmd(})0i3>Y2uUA5k3ec_s^#JgTM4l4s!^OkIWI)<x(hyBk&ySvX|4E9C|H@!~
z`*Q9aKVXs}7lF*aFDP6c|8@Giot;|z_o~y~d5-^{qI~_Tro$0U5qzTy!CV2}5J6+%
z!~MNi&Z!;%cW2e8Hk*I_3N($Ad^krqM)^C=KB*;!4_iYTOYrrR@F6fiz`wzn5B{8X
zP@wc%ihfflut`!5;)0-A$!?5DAwh$_Ik?yuu_p9}u)qXk$#nQWB{H5Il50$?TP0bh
znF!7>K_W0XR#Vvhy{FU!(_!(mrZE{CI;vtOw<at)MvlN&b%ymozY0>*AX=!9WDNKB
zzSkg_GJf_UFnldEQS<z~dQ}e`WO{I%(A*8Nb+Eg^L9%25LnDZ@+|hO$ML!-nL!qEp
z4ecMRrv;TK>uX8S?d>{s)@pNq@9AGkAZ;76O{C0>e2SpuRL7Fv$G9Rh7e>aJWHC!3
zxOjW&K@)C8R2-SG_JfYPmyu|}9i%i>i(=?HUBAEgnz}AAo}@G;$$=0#aw7%R?nS)@
zqCH5ckVOMd(lNpds%u}ui<qS&I##U;i<UeW5{Cu6g`=aQZ9v6EmB@19d&*U*5nQY)
z(d9g;^tbx!Z;Ynkzw{e0td-KWa(09CmU5OVb<<KRROImF{pI1{)8Nnp(A#QSJGKfb
zBy8LY61>F(?!fN8fKSsAt6(`BygxWOuAnF|a2%@ztJ8RJ{OREA<oIZCe9;Jjb5>oj
z^TF}O*<UZ$K?_VJpH+~|IbTEK;AsE-;PPVs{T%b6_b;4$73g^XXs`;(&Kdr4^{iXX
zqH+hW7B=ZY!P3Rx?T6!oxBG{e2j}M>2WRIMNv%?$l0uCcBh@yhx0a29)VqVT!P|?2
zPlNNz{f`$PPR<Vgd;j9#<oI%My#MBK@UAM8tx~aulw&OEEs9n^ayem~{+&q5(pF%X
zKF+Y|HBc$N<*ra``nlN=tmx<I$=OBo=qP9QP|SZ}*A=V>=NAVjm;d$g;No)s^k9x(
zx!q`cyVHFYgh3c|qRvj(4cAbJSz<z+WtRH(<nVCt_TuF1@_cai>ELZ$=Ndwop#Dx|
zB*xW9KMl^#7i_t}aaQa<-N7F@lS@zyj^CZ09MtS{i=@L+>P%u%d2qWw%ot5&%XK&j
zi%BwJLPq^w=as*HQZ$=8%S8EMuzz^*;c`(cO7%4GEu$WDMtZ&1zdk@)4D^0FJS#T7
z{3S6T%a9Yv_y-qaW*{CA2(ALZzxRr*uT##h_0mUa=6keTD`unW`(gpp)1V*}D4b4g
zuz_g9QgDNg#l5u6cA}2Ipj+F5+)Te*oOaD)_7fj{&@7#Q=`kz%@Pmh}+~9unK`SXe
z&9F6Y$#1wL4K$v3_*OeviF`^^9h|)9B*xPU0%#l0UalKfwRWbGPPm?O?Ub&h^&LW}
zqkKUBo0e~FXEwD57T$)JnHFtD9jlAYa+#}{YTE;ojWW?-5>*}w(J6s6uD(ikg4+3p
z5n{ukhq8>5G?|?-CV!&|ikXl&El+RsfyFUPRdxANU>vilnlnZ;vAdjRNAN69C7t3s
zqjv64H?o_t;lmmIE>7&p{eB#?Je9}AHe7wMFqKr!^!mw$L?oANs$kA57%tcirW!@c
zBy8ay^JuQ%y%j8jGfRxRF*FHCWEg*&gv`0r_vv8`cTgfO_rsiHtVbZFF_&}s;}9CT
zRMw0_xfCyaqFxklRo2`syHwY;O>1~V#4IgMBXhBEKg;Ybvj*q5mMNpDE4WIXUFyb7
zf@ORy+1_5q(b8$d<u|Y!+RbgWpzG_AA8`J&c>ZVHgObd5AN<*}?*3<gw|@U?XQ$VB
zKL2})(xBp%`N6R|JMW5$@id+kWt^sR1pdD(7v(g*Q&U<R!)~w1Cg)IX4Oqdv291pu
zDzSsxHEwZLJ5}McLT)*UA3b0jE{pbW=9@#tZt`q19$=0A@Amrj^Z(tj|9t-cB<1VZ
z?O(tH_$^OkbL)FC?C=2Ix%a|#1bU_x6L^aPh}rLh5oc3yE)v7_4B`pKH#8l?4bBA6
z6y$^oV0@?oIE|+hz{xFgPKT%(y@YN6?-O=S67$##K%2gLf|vaOY_zMM1I0zoQvoCe
zoMv(cLUMgea|9_%5%3EYGVnZr)AEX$iJ;pM+~6#N-*KjQ6F@RZjM5kNCX$H223hR-
zZy3wK`(?X%RaXhr+B&Y&M-w+VJ5>atJx$WBGSYGm$&BZ+wam&zu^8<+-l`CoKS%B$
z9c$^;fXvH4dAcSTyN0d-l@~(H9pOdjN<S2&@AjOIK&=_-0nmhqV-ymHzpJ3N7SR?W
zF%hjRf>sNBwIcG14H}2?;#toar6JNBIIkcBCI5PI+CV4D0eQ?W%!zEi19r$Cll_9k
z=9!<X_G9wzP^opH-9)TnCq-ycY16K)MH){<Dq<)gwtw+1l$RY@mu{S}0IpVtg5F{>
zQ*tGcYFO=9wVxF5naT-Gfxwhxf%j36B{#ZO%D=WKy}?;W`Ms|C(=%&P>$c4n2QY5W
zBe$*@OOT{3<z!uvOi5OEl8eq&WC@jrR7mgxf5FwVTxPjc?F=o)ed)<U!qyE<hX(@u
zDam|IvsF<Pi@`;(sHq92jxu+e5lo0so>q5jYecz_4onTNiy+Q9$F%U$RlusAah#fu
zwSHIgZnOs+-L`l3`a|GX!BYGpkBqFxC=G)yRktx6K~-P{ux(TC^tah?fy|m$r9Z6-
zAFh;Ejnv%MDu%b9Aq$4LWUj9`ho!d1%P>h!&<09GR*mnWR=36@eT&^)xXkEJZRYIg
zXozv}(>zIhHO~5z81;6@P-t7Ran<Im^qWj^L};=^DrK}b&4q+(G*b1y-CF5rwV75l
zt~8b<*1Swpt%#Q^=u>-uTCZJt6~@0&HMg3)N$Vdn?zJLY+{XK}t=TtO7T5o^kLEV8
z1+Z@auiLNh|Lyi)J+J?tq^vq4H45ODH@D~SDtBTxbbM;5wQ3t~KUzS4^3q`cLQ*y`
zHwK?%|1a!@3-%v|yU+Ij6s5`j9R=9P1qp?(xP$s^-~U`?(f(zY*iGCG9sjMf|4whG
zS3m#j_nz}VJW0{}|F?7+fj|i(nxLFzxTjW6B%WXdcDH-`7w-(yA@cctzfQ$a9tsv3
z1R3%P$;@67h?r$qEFtZKfXrk?DAu}7{$;L(T$A--3yhb!H9n`jZcgMRkSvfBG_Mp2
zdxzu&w3gfw-Vl0UcgcqrB+Cq~WrqWc1dA<$`R2Kjyjt{{GYlUBQ*#IUYi2$xUTn=P
z*k8#sX+gswt^f6_4_lJ`MX=NYIy;ke1c4cj%Hm3932engD(JQu!56_9CPdO(JlE~p
z_xHu-r)gzYS$+$)rpU)wOa>Jw-%@KqV5L{zC3Ti_iU~`gXx+TLt1pfXO!IY)=b5It
zSpOePFqzVE$~bPG#=7_~>~!n-e|C4nXaD~cMWT>xoy6uxbMjn%M6vdNHrRi6Gzg}{
z$Dpz9{>S3_uN!uH&-VWm<>w-ApZCygf8M|S&xM=g?|-)@Qf4CB-lo%WASM)(p$I73
zz9z#lZmYI!+q6y75#v*Rm7gU4Dda4{y-`ABTl|p|jxF!!pY8s=cc*V=+<}6JyYkk@
zoqH7p?!3FUD&}wTukuSjdF59EB5+ceIUhz|GnT*|T<H^|D;-)rAg38rFgGNxfIFc2
zd)ccUg>?RUIh>P;Vh$Zz=t|`h9QE(~;m%%NQHZ|!ahCg$NfGwaw;#nvHaFP4BJ<D`
zWDj7VOeogGLchjAxP*ZfS;<zgu$cd1F3sMR{%mAT60oJni%cGHS6nx`gDbz1Ys{}v
zn1i@DYpIR?A$6?hI;v6_jY$Jm$@6tcm*knMVy}JXR~zMpFUX?KOJ9Fu70q*n=>cDw
zZmf}9R{Q?P4r)i+NF~WyGr0Kx)k3`vUw2$MUD*IN&&O8nWYecs(ayY|HfPyOzxt6>
z)CqOZm#2Aa<f6!$wocH!aDf9&Zdul~DzSP}#EP1`X$`fOZzzT05*BPi$O;QKiDQNM
z1`|itIB|C`zr}_$U=uEz_RV~oQ0<th(LHNO9#=)?e$7?UXERqgIq#})&F$T+pVjtD
zJ}Q}`=!T(2u_n9QYOM2bVjMSZ5wA=+_W-mXg=#kU69((56nJpwsZhk;vsA-lqY|&Y
zIAL$IB3zXzRIik-nHyImg=;jS)6iUuWpaYN(DmyX<U*lU2+Xb1`IV8TE%pEoB+zM=
zpmNHhfMJRSjtDxTh=@F|6Tl&3H^#cIZg5uI6}>9>)hzsnaBu2*-3pYwD|&;o1t7+i
z*HANB6PjKCABDZ@a@7RxHtxHP>o-j`uyd_gHImw_t}$Vs1JCQggy@~bSQ&1Nz;2O4
z*Zk|5e|_L6GLsb}nFXM)=8!DojKmY=d)Q~wWttA@Egj~h^hT1wgxn%bX-cQ+wazJ%
za~-?BgwGS2AP7m51g=qyq-IVsD6W#a-c=`CNM?cO4ZaXHh~CxJmDg#NyNv6zG?jOx
z_n;sCx_k7->(0ULfUU;@d(aL0uaDk%y>B57d(a8H{i8Qte-2h3vIn6lzSULX<{K@A
zAH4wje_rbA|6t7IbVKJpMOnN57lyU<f3Fulum7LRb9pY$<x$K31pom5|KL|K(g0=v
E0I}Jw(EtDd

literal 0
HcmV?d00001

diff --git a/charts/account-operator/tests/__snapshot__/deployment_test.yaml.snap b/charts/account-operator/tests/__snapshot__/deployment_test.yaml.snap
index 9fd7469e4..db47f55aa 100644
--- a/charts/account-operator/tests/__snapshot__/deployment_test.yaml.snap
+++ b/charts/account-operator/tests/__snapshot__/deployment_test.yaml.snap
@@ -278,6 +278,8 @@ operator match the snapshot:
     apiVersion: apps/v1
     kind: Deployment
     metadata:
+      annotations:
+        cert-manager.io/inject-ca-from: NAMESPACE/account-operator-serving-cert
       name: account-operator
     spec:
       revisionHistoryLimit: 3
@@ -286,7 +288,8 @@ operator match the snapshot:
           service: account-operator
       template:
         metadata:
-          annotations: null
+          annotations:
+            traffic.sidecar.istio.io/excludeInboundPorts: "9443"
           labels:
             control-plane: controller-manager
             service: account-operator
@@ -296,7 +299,7 @@ operator match the snapshot:
             - args:
                 - operator
                 - --leader-elect
-                - --log-level=warn
+                - --log-level=debug
                 - --health-probe-bind-address=:8081
               env:
                 - name: SUBROUTINES_NAMESPACE_ENABLED
@@ -304,7 +307,7 @@ operator match the snapshot:
                 - name: SUBROUTINES_FGA_ENABLED
                   value: "true"
                 - name: SUBROUTINES_FGA_GRPC_ADDR
-                  value: ""
+                  value: openmfp-openfga:8081
                 - name: SUBROUTINES_FGA_ROOT_NAMESPACE
                   value: openmfp-root
                 - name: SUBROUTINES_FGA_OBJECT_TYPE
@@ -322,7 +325,7 @@ operator match the snapshot:
                 - name: KCP_VIRTUAL_WORKSPACE_URL
                   value: ""
                 - name: WEBHOOKS_ENABLED
-                  value: "false"
+                  value: "true"
                 - name: WEBHOOKS_CERT_DIR
                   value: /certs
               image: ghcr.io/openmfp/account-operator:0.0.0
@@ -340,6 +343,9 @@ operator match the snapshot:
                 - containerPort: 8081
                   name: health-port
                   protocol: TCP
+                - containerPort: 9443
+                  name: webhook-port
+                  protocol: TCP
               readinessProbe:
                 httpGet:
                   path: /readyz
@@ -364,7 +370,10 @@ operator match the snapshot:
                   path: /readyz
                   port: 8081
                 periodSeconds: 10
-              volumeMounts: null
+              volumeMounts:
+                - mountPath: /certs
+                  name: cert
+                  readOnly: true
           hostAliases:
             - hostnames:
                 - kcp.dev.local
@@ -375,7 +384,11 @@ operator match the snapshot:
               type: RuntimeDefault
           serviceAccountName: account-operator
           terminationGracePeriodSeconds: 10
-          volumes: null
+          volumes:
+            - name: cert
+              secret:
+                defaultMode: 420
+                secretName: account-operator-webhook-server-cert
   5: |
     apiVersion: v1
     imagePullSecrets:
@@ -383,6 +396,66 @@ operator match the snapshot:
     kind: ServiceAccount
     metadata:
       name: account-operator
+  6: |
+    apiVersion: admissionregistration.k8s.io/v1
+    kind: MutatingWebhookConfiguration
+    metadata:
+      annotations:
+        cert-manager.io/inject-ca-from: NAMESPACE/account-operator-serving-cert
+      name: account-operator-mutating-webhook-configuration
+    webhooks:
+      - admissionReviewVersions:
+          - v1
+        clientConfig:
+          service:
+            name: account-operator-webhook
+            namespace: NAMESPACE
+            path: /mutate-core-openmfp-io-v1alpha1-account
+        failurePolicy: Fail
+        name: maccount.kb.io
+        rules:
+          - apiGroups:
+              - core.openmfp.io
+            apiVersions:
+              - v1alpha1
+            operations:
+              - CREATE
+            resources:
+              - accounts
+        sideEffects: None
+  7: |
+    apiVersion: cert-manager.io/v1
+    kind: Issuer
+    metadata:
+      name: account-operator-selfsigned-issuer
+    spec:
+      selfSigned: {}
+  8: |
+    apiVersion: cert-manager.io/v1
+    kind: Certificate
+    metadata:
+      name: account-operator-serving-cert
+    spec:
+      dnsNames:
+        - account-operator-webhook.NAMESPACE.svc
+        - account-operator-webhook.NAMESPACE.svc.cluster.local
+      issuerRef:
+        kind: Issuer
+        name: account-operator-selfsigned-issuer
+      secretName: account-operator-webhook-server-cert
+  9: |
+    apiVersion: v1
+    kind: Service
+    metadata:
+      name: account-operator-webhook
+    spec:
+      ports:
+        - port: 443
+          protocol: TCP
+          targetPort: 9443
+      selector:
+        control-plane: controller-manager
+        service: account-operator
 operator match the snapshot (with kubeconfigSecret):
   1: |
     apiVersion: apiextensions.k8s.io/v1
@@ -663,6 +736,8 @@ operator match the snapshot (with kubeconfigSecret):
     apiVersion: apps/v1
     kind: Deployment
     metadata:
+      annotations:
+        cert-manager.io/inject-ca-from: NAMESPACE/account-operator-serving-cert
       name: account-operator
     spec:
       revisionHistoryLimit: 3
@@ -671,7 +746,8 @@ operator match the snapshot (with kubeconfigSecret):
           service: account-operator
       template:
         metadata:
-          annotations: null
+          annotations:
+            traffic.sidecar.istio.io/excludeInboundPorts: "9443"
           labels:
             control-plane: controller-manager
             service: account-operator
@@ -681,7 +757,7 @@ operator match the snapshot (with kubeconfigSecret):
             - args:
                 - operator
                 - --leader-elect
-                - --log-level=warn
+                - --log-level=debug
                 - --health-probe-bind-address=:8081
               env:
                 - name: SUBROUTINES_NAMESPACE_ENABLED
@@ -689,7 +765,7 @@ operator match the snapshot (with kubeconfigSecret):
                 - name: SUBROUTINES_FGA_ENABLED
                   value: "true"
                 - name: SUBROUTINES_FGA_GRPC_ADDR
-                  value: ""
+                  value: openmfp-openfga:8081
                 - name: SUBROUTINES_FGA_ROOT_NAMESPACE
                   value: openmfp-root
                 - name: SUBROUTINES_FGA_OBJECT_TYPE
@@ -707,7 +783,7 @@ operator match the snapshot (with kubeconfigSecret):
                 - name: KCP_VIRTUAL_WORKSPACE_URL
                   value: ""
                 - name: WEBHOOKS_ENABLED
-                  value: "false"
+                  value: "true"
                 - name: WEBHOOKS_CERT_DIR
                   value: /certs
                 - name: KUBECONFIG
@@ -727,6 +803,9 @@ operator match the snapshot (with kubeconfigSecret):
                 - containerPort: 8081
                   name: health-port
                   protocol: TCP
+                - containerPort: 9443
+                  name: webhook-port
+                  protocol: TCP
               readinessProbe:
                 httpGet:
                   path: /readyz
@@ -754,6 +833,9 @@ operator match the snapshot (with kubeconfigSecret):
               volumeMounts:
                 - mountPath: /api-kubeconfig
                   name: external-api-server
+                - mountPath: /certs
+                  name: cert
+                  readOnly: true
           securityContext:
             runAsNonRoot: true
             seccompProfile:
@@ -764,6 +846,10 @@ operator match the snapshot (with kubeconfigSecret):
             - name: external-api-server
               secret:
                 secretName: kubeconfig
+            - name: cert
+              secret:
+                defaultMode: 420
+                secretName: account-operator-webhook-server-cert
   5: |
     apiVersion: v1
     imagePullSecrets:
@@ -771,6 +857,66 @@ operator match the snapshot (with kubeconfigSecret):
     kind: ServiceAccount
     metadata:
       name: account-operator
+  6: |
+    apiVersion: admissionregistration.k8s.io/v1
+    kind: MutatingWebhookConfiguration
+    metadata:
+      annotations:
+        cert-manager.io/inject-ca-from: NAMESPACE/account-operator-serving-cert
+      name: account-operator-mutating-webhook-configuration
+    webhooks:
+      - admissionReviewVersions:
+          - v1
+        clientConfig:
+          service:
+            name: account-operator-webhook
+            namespace: NAMESPACE
+            path: /mutate-core-openmfp-io-v1alpha1-account
+        failurePolicy: Fail
+        name: maccount.kb.io
+        rules:
+          - apiGroups:
+              - core.openmfp.io
+            apiVersions:
+              - v1alpha1
+            operations:
+              - CREATE
+            resources:
+              - accounts
+        sideEffects: None
+  7: |
+    apiVersion: cert-manager.io/v1
+    kind: Issuer
+    metadata:
+      name: account-operator-selfsigned-issuer
+    spec:
+      selfSigned: {}
+  8: |
+    apiVersion: cert-manager.io/v1
+    kind: Certificate
+    metadata:
+      name: account-operator-serving-cert
+    spec:
+      dnsNames:
+        - account-operator-webhook.NAMESPACE.svc
+        - account-operator-webhook.NAMESPACE.svc.cluster.local
+      issuerRef:
+        kind: Issuer
+        name: account-operator-selfsigned-issuer
+      secretName: account-operator-webhook-server-cert
+  9: |
+    apiVersion: v1
+    kind: Service
+    metadata:
+      name: account-operator-webhook
+    spec:
+      ports:
+        - port: 443
+          protocol: TCP
+          targetPort: 9443
+      selector:
+        control-plane: controller-manager
+        service: account-operator
 operator match the snapshot with webhook enabled:
   1: |
     apiVersion: apiextensions.k8s.io/v1
@@ -1072,7 +1218,7 @@ operator match the snapshot with webhook enabled:
             - args:
                 - operator
                 - --leader-elect
-                - --log-level=warn
+                - --log-level=debug
                 - --health-probe-bind-address=:8081
               env:
                 - name: SUBROUTINES_NAMESPACE_ENABLED
@@ -1080,7 +1226,7 @@ operator match the snapshot with webhook enabled:
                 - name: SUBROUTINES_FGA_ENABLED
                   value: "true"
                 - name: SUBROUTINES_FGA_GRPC_ADDR
-                  value: ""
+                  value: openmfp-openfga:8081
                 - name: SUBROUTINES_FGA_ROOT_NAMESPACE
                   value: openmfp-root
                 - name: SUBROUTINES_FGA_OBJECT_TYPE
diff --git a/charts/account-operator/values.yaml b/charts/account-operator/values.yaml
index 86ba12136..ca2b9e77c 100644
--- a/charts/account-operator/values.yaml
+++ b/charts/account-operator/values.yaml
@@ -10,7 +10,7 @@ crds:
 
 webhooks:
   # -- Enable webhooks
-  enabled: false
+  enabled: true
   # -- The directory for webhook certificates
   certDir: /certs
 
@@ -29,7 +29,7 @@ subroutines:
     # -- Enable FGA subroutines
     enabled: true
     # -- The gRPC address for FGA
-    grpcAddr: ""
+    grpcAddr: openmfp-openfga:8081
     # -- The root namespace for FGA
     rootNamespace: openmfp-root
     # -- The object type for FGA
@@ -48,7 +48,7 @@ subroutines:
 # -- The secret for kubeconfig
 kubeconfigSecret: ""
 # -- The log level
-logLevel: warn
+logLevel: debug
 
 security:
   # -- Mount the service account token