diff --git a/class/defaults.yml b/class/defaults.yml
index d0c9f9d..73c351d 100644
--- a/class/defaults.yml
+++ b/class/defaults.yml
@@ -10,7 +10,7 @@ parameters:
     charts:
       openstack-cloud-controller-manager:
         source: https://kubernetes.github.io/cloud-provider-openstack
-        version: "2.36.1"
+        version: "2.36.3"
       openstack-cinder-csi:
         source: https://kubernetes.github.io/cloud-provider-openstack
         version: "2.36.2"
diff --git a/tests/golden/cloud-config/cloud-provider-openstack/cloud-provider-openstack/10_ccm_helm_chart/openstack-cloud-controller-manager/templates/clusterrole.yaml b/tests/golden/cloud-config/cloud-provider-openstack/cloud-provider-openstack/10_ccm_helm_chart/openstack-cloud-controller-manager/templates/clusterrole.yaml
index e82688d..104b2e5 100644
--- a/tests/golden/cloud-config/cloud-provider-openstack/cloud-provider-openstack/10_ccm_helm_chart/openstack-cloud-controller-manager/templates/clusterrole.yaml
+++ b/tests/golden/cloud-config/cloud-provider-openstack/cloud-provider-openstack/10_ccm_helm_chart/openstack-cloud-controller-manager/templates/clusterrole.yaml
@@ -7,7 +7,7 @@ metadata:
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: openstack-cloud-controller-manager
     app.kubernetes.io/version: v1.36.0
-    helm.sh/chart: openstack-cloud-controller-manager-2.36.1
+    helm.sh/chart: openstack-cloud-controller-manager-2.36.3
   name: system:cloud-controller-manager
 rules:
   - apiGroups:
@@ -31,7 +31,11 @@ rules:
     resources:
       - nodes
     verbs:
-      - '*'
+      - get
+      - list
+      - watch
+      - patch
+      - update
   - apiGroups:
       - ''
     resources:
@@ -66,12 +70,6 @@ rules:
     verbs:
       - create
       - get
-  - apiGroups:
-      - ''
-    resources:
-      - persistentvolumes
-    verbs:
-      - '*'
   - apiGroups:
       - ''
     resources:
@@ -90,11 +88,3 @@ rules:
       - get
       - list
       - watch
-  - apiGroups:
-      - ''
-    resources:
-      - secrets
-    verbs:
-      - list
-      - get
-      - watch
diff --git a/tests/golden/cloud-config/cloud-provider-openstack/cloud-provider-openstack/10_ccm_helm_chart/openstack-cloud-controller-manager/templates/clusterrolebinding-sm.yaml b/tests/golden/cloud-config/cloud-provider-openstack/cloud-provider-openstack/10_ccm_helm_chart/openstack-cloud-controller-manager/templates/clusterrolebinding-sm.yaml
index 0220c2e..437767c 100644
--- a/tests/golden/cloud-config/cloud-provider-openstack/cloud-provider-openstack/10_ccm_helm_chart/openstack-cloud-controller-manager/templates/clusterrolebinding-sm.yaml
+++ b/tests/golden/cloud-config/cloud-provider-openstack/cloud-provider-openstack/10_ccm_helm_chart/openstack-cloud-controller-manager/templates/clusterrolebinding-sm.yaml
@@ -7,7 +7,7 @@ metadata:
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: openstack-cloud-controller-manager
     app.kubernetes.io/version: v1.36.0
-    helm.sh/chart: openstack-cloud-controller-manager-2.36.1
+    helm.sh/chart: openstack-cloud-controller-manager-2.36.3
   name: system:openstack-cloud-controller-manager:auth-delegate
 roleRef:
   apiGroup: rbac.authorization.k8s.io
diff --git a/tests/golden/cloud-config/cloud-provider-openstack/cloud-provider-openstack/10_ccm_helm_chart/openstack-cloud-controller-manager/templates/clusterrolebinding.yaml b/tests/golden/cloud-config/cloud-provider-openstack/cloud-provider-openstack/10_ccm_helm_chart/openstack-cloud-controller-manager/templates/clusterrolebinding.yaml
index 4cba769..243db6b 100644
--- a/tests/golden/cloud-config/cloud-provider-openstack/cloud-provider-openstack/10_ccm_helm_chart/openstack-cloud-controller-manager/templates/clusterrolebinding.yaml
+++ b/tests/golden/cloud-config/cloud-provider-openstack/cloud-provider-openstack/10_ccm_helm_chart/openstack-cloud-controller-manager/templates/clusterrolebinding.yaml
@@ -7,7 +7,7 @@ metadata:
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: openstack-cloud-controller-manager
     app.kubernetes.io/version: v1.36.0
-    helm.sh/chart: openstack-cloud-controller-manager-2.36.1
+    helm.sh/chart: openstack-cloud-controller-manager-2.36.3
   name: system:cloud-controller-manager
 roleRef:
   apiGroup: rbac.authorization.k8s.io
diff --git a/tests/golden/cloud-config/cloud-provider-openstack/cloud-provider-openstack/10_ccm_helm_chart/openstack-cloud-controller-manager/templates/daemonset.yaml b/tests/golden/cloud-config/cloud-provider-openstack/cloud-provider-openstack/10_ccm_helm_chart/openstack-cloud-controller-manager/templates/daemonset.yaml
index 461ca28..3fd4ad2 100644
--- a/tests/golden/cloud-config/cloud-provider-openstack/cloud-provider-openstack/10_ccm_helm_chart/openstack-cloud-controller-manager/templates/daemonset.yaml
+++ b/tests/golden/cloud-config/cloud-provider-openstack/cloud-provider-openstack/10_ccm_helm_chart/openstack-cloud-controller-manager/templates/daemonset.yaml
@@ -7,7 +7,7 @@ metadata:
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: openstack-cloud-controller-manager
     app.kubernetes.io/version: v1.36.0
-    helm.sh/chart: openstack-cloud-controller-manager-2.36.1
+    helm.sh/chart: openstack-cloud-controller-manager-2.36.3
   name: openstack-cloud-controller-manager
   namespace: syn-cloud-provider-openstack
 spec:
@@ -22,7 +22,7 @@ spec:
         checksum/config: b0b31d6311d187dd53758033396c83505652c1ec8a62bef0b9afe7f9572f8db4
       labels:
         app: openstack-cloud-controller-manager
-        chart: openstack-cloud-controller-manager-2.36.1
+        chart: openstack-cloud-controller-manager-2.36.3
         component: controllermanager
         heritage: Helm
         release: openstack-ccm
@@ -36,6 +36,7 @@ spec:
             - --cloud-provider=openstack
             - --use-service-account-credentials=false
             - --controllers=cloud-node,cloud-node-lifecycle,service
+            - --authorization-always-allow-paths=/metrics
             - --bind-address=0.0.0.0
           env:
             - name: CLOUD_CONFIG
diff --git a/tests/golden/cloud-config/cloud-provider-openstack/cloud-provider-openstack/10_ccm_helm_chart/openstack-cloud-controller-manager/templates/role.yaml b/tests/golden/cloud-config/cloud-provider-openstack/cloud-provider-openstack/10_ccm_helm_chart/openstack-cloud-controller-manager/templates/role.yaml
new file mode 100644
index 0000000..cf8ef1e
--- /dev/null
+++ b/tests/golden/cloud-config/cloud-provider-openstack/cloud-provider-openstack/10_ccm_helm_chart/openstack-cloud-controller-manager/templates/role.yaml
@@ -0,0 +1,23 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  annotations: null
+  labels:
+    app.kubernetes.io/instance: openstack-ccm
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: openstack-cloud-controller-manager
+    app.kubernetes.io/version: v1.36.0
+    helm.sh/chart: openstack-cloud-controller-manager-2.36.3
+  name: system:cloud-controller-manager:secret-reader
+  namespace: syn-cloud-provider-openstack
+rules:
+  - apiGroups:
+      - ''
+    resourceNames:
+      - cloud-config
+    resources:
+      - secrets
+    verbs:
+      - get
+      - list
+      - watch
diff --git a/tests/golden/cloud-config/cloud-provider-openstack/cloud-provider-openstack/10_ccm_helm_chart/openstack-cloud-controller-manager/templates/rolebinding.yaml b/tests/golden/cloud-config/cloud-provider-openstack/cloud-provider-openstack/10_ccm_helm_chart/openstack-cloud-controller-manager/templates/rolebinding.yaml
new file mode 100644
index 0000000..5a4ae4b
--- /dev/null
+++ b/tests/golden/cloud-config/cloud-provider-openstack/cloud-provider-openstack/10_ccm_helm_chart/openstack-cloud-controller-manager/templates/rolebinding.yaml
@@ -0,0 +1,20 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  annotations: null
+  labels:
+    app.kubernetes.io/instance: openstack-ccm
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: openstack-cloud-controller-manager
+    app.kubernetes.io/version: v1.36.0
+    helm.sh/chart: openstack-cloud-controller-manager-2.36.3
+  name: system:cloud-controller-manager:secret-reader
+  namespace: syn-cloud-provider-openstack
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: system:cloud-controller-manager:secret-reader
+subjects:
+  - kind: ServiceAccount
+    name: cloud-controller-manager
+    namespace: syn-cloud-provider-openstack
diff --git a/tests/golden/cloud-config/cloud-provider-openstack/cloud-provider-openstack/10_ccm_helm_chart/openstack-cloud-controller-manager/templates/service-sm.yaml b/tests/golden/cloud-config/cloud-provider-openstack/cloud-provider-openstack/10_ccm_helm_chart/openstack-cloud-controller-manager/templates/service-sm.yaml
index 0cebc3d..271c682 100644
--- a/tests/golden/cloud-config/cloud-provider-openstack/cloud-provider-openstack/10_ccm_helm_chart/openstack-cloud-controller-manager/templates/service-sm.yaml
+++ b/tests/golden/cloud-config/cloud-provider-openstack/cloud-provider-openstack/10_ccm_helm_chart/openstack-cloud-controller-manager/templates/service-sm.yaml
@@ -7,7 +7,7 @@ metadata:
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: openstack-cloud-controller-manager
     app.kubernetes.io/version: v1.36.0
-    helm.sh/chart: openstack-cloud-controller-manager-2.36.1
+    helm.sh/chart: openstack-cloud-controller-manager-2.36.3
   name: openstack-cloud-controller-manager
   namespace: syn-cloud-provider-openstack
 spec:
diff --git a/tests/golden/cloud-config/cloud-provider-openstack/cloud-provider-openstack/10_ccm_helm_chart/openstack-cloud-controller-manager/templates/serviceaccount.yaml b/tests/golden/cloud-config/cloud-provider-openstack/cloud-provider-openstack/10_ccm_helm_chart/openstack-cloud-controller-manager/templates/serviceaccount.yaml
index fd67e06..a6dcc9c 100644
--- a/tests/golden/cloud-config/cloud-provider-openstack/cloud-provider-openstack/10_ccm_helm_chart/openstack-cloud-controller-manager/templates/serviceaccount.yaml
+++ b/tests/golden/cloud-config/cloud-provider-openstack/cloud-provider-openstack/10_ccm_helm_chart/openstack-cloud-controller-manager/templates/serviceaccount.yaml
@@ -7,6 +7,6 @@ metadata:
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: openstack-cloud-controller-manager
     app.kubernetes.io/version: v1.36.0
-    helm.sh/chart: openstack-cloud-controller-manager-2.36.1
+    helm.sh/chart: openstack-cloud-controller-manager-2.36.3
   name: cloud-controller-manager
   namespace: syn-cloud-provider-openstack
diff --git a/tests/golden/cloud-config/cloud-provider-openstack/cloud-provider-openstack/10_ccm_helm_chart/openstack-cloud-controller-manager/templates/servicemonitor.yaml b/tests/golden/cloud-config/cloud-provider-openstack/cloud-provider-openstack/10_ccm_helm_chart/openstack-cloud-controller-manager/templates/servicemonitor.yaml
index 21dafde..1ac9256 100644
--- a/tests/golden/cloud-config/cloud-provider-openstack/cloud-provider-openstack/10_ccm_helm_chart/openstack-cloud-controller-manager/templates/servicemonitor.yaml
+++ b/tests/golden/cloud-config/cloud-provider-openstack/cloud-provider-openstack/10_ccm_helm_chart/openstack-cloud-controller-manager/templates/servicemonitor.yaml
@@ -7,13 +7,12 @@ metadata:
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: openstack-cloud-controller-manager
     app.kubernetes.io/version: v1.36.0
-    helm.sh/chart: openstack-cloud-controller-manager-2.36.1
+    helm.sh/chart: openstack-cloud-controller-manager-2.36.3
   name: openstack-cloud-controller-manager
   namespace: syn-cloud-provider-openstack
 spec:
   endpoints:
-    - bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
-      interval: 30s
+    - interval: 30s
       port: http
       scheme: https
       tlsConfig:
@@ -21,6 +20,8 @@ spec:
   jobLabel: component
   selector:
     matchLabels:
-      app: openstack-cloud-controller-manager
-      component: controllermanager
-      release: openstack-ccm
+      app.kubernetes.io/instance: openstack-ccm
+      app.kubernetes.io/managed-by: Helm
+      app.kubernetes.io/name: openstack-cloud-controller-manager
+      app.kubernetes.io/version: v1.36.0
+      helm.sh/chart: openstack-cloud-controller-manager-2.36.3
diff --git a/tests/golden/defaults/cloud-provider-openstack/cloud-provider-openstack/10_ccm_helm_chart/openstack-cloud-controller-manager/templates/clusterrole.yaml b/tests/golden/defaults/cloud-provider-openstack/cloud-provider-openstack/10_ccm_helm_chart/openstack-cloud-controller-manager/templates/clusterrole.yaml
index e82688d..104b2e5 100644
--- a/tests/golden/defaults/cloud-provider-openstack/cloud-provider-openstack/10_ccm_helm_chart/openstack-cloud-controller-manager/templates/clusterrole.yaml
+++ b/tests/golden/defaults/cloud-provider-openstack/cloud-provider-openstack/10_ccm_helm_chart/openstack-cloud-controller-manager/templates/clusterrole.yaml
@@ -7,7 +7,7 @@ metadata:
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: openstack-cloud-controller-manager
     app.kubernetes.io/version: v1.36.0
-    helm.sh/chart: openstack-cloud-controller-manager-2.36.1
+    helm.sh/chart: openstack-cloud-controller-manager-2.36.3
   name: system:cloud-controller-manager
 rules:
   - apiGroups:
@@ -31,7 +31,11 @@ rules:
     resources:
       - nodes
     verbs:
-      - '*'
+      - get
+      - list
+      - watch
+      - patch
+      - update
   - apiGroups:
       - ''
     resources:
@@ -66,12 +70,6 @@ rules:
     verbs:
       - create
       - get
-  - apiGroups:
-      - ''
-    resources:
-      - persistentvolumes
-    verbs:
-      - '*'
   - apiGroups:
       - ''
     resources:
@@ -90,11 +88,3 @@ rules:
       - get
       - list
       - watch
-  - apiGroups:
-      - ''
-    resources:
-      - secrets
-    verbs:
-      - list
-      - get
-      - watch
diff --git a/tests/golden/defaults/cloud-provider-openstack/cloud-provider-openstack/10_ccm_helm_chart/openstack-cloud-controller-manager/templates/clusterrolebinding.yaml b/tests/golden/defaults/cloud-provider-openstack/cloud-provider-openstack/10_ccm_helm_chart/openstack-cloud-controller-manager/templates/clusterrolebinding.yaml
index 4cba769..243db6b 100644
--- a/tests/golden/defaults/cloud-provider-openstack/cloud-provider-openstack/10_ccm_helm_chart/openstack-cloud-controller-manager/templates/clusterrolebinding.yaml
+++ b/tests/golden/defaults/cloud-provider-openstack/cloud-provider-openstack/10_ccm_helm_chart/openstack-cloud-controller-manager/templates/clusterrolebinding.yaml
@@ -7,7 +7,7 @@ metadata:
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: openstack-cloud-controller-manager
     app.kubernetes.io/version: v1.36.0
-    helm.sh/chart: openstack-cloud-controller-manager-2.36.1
+    helm.sh/chart: openstack-cloud-controller-manager-2.36.3
   name: system:cloud-controller-manager
 roleRef:
   apiGroup: rbac.authorization.k8s.io
diff --git a/tests/golden/defaults/cloud-provider-openstack/cloud-provider-openstack/10_ccm_helm_chart/openstack-cloud-controller-manager/templates/daemonset.yaml b/tests/golden/defaults/cloud-provider-openstack/cloud-provider-openstack/10_ccm_helm_chart/openstack-cloud-controller-manager/templates/daemonset.yaml
index dd1b7d0..1299b41 100644
--- a/tests/golden/defaults/cloud-provider-openstack/cloud-provider-openstack/10_ccm_helm_chart/openstack-cloud-controller-manager/templates/daemonset.yaml
+++ b/tests/golden/defaults/cloud-provider-openstack/cloud-provider-openstack/10_ccm_helm_chart/openstack-cloud-controller-manager/templates/daemonset.yaml
@@ -7,7 +7,7 @@ metadata:
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: openstack-cloud-controller-manager
     app.kubernetes.io/version: v1.36.0
-    helm.sh/chart: openstack-cloud-controller-manager-2.36.1
+    helm.sh/chart: openstack-cloud-controller-manager-2.36.3
   name: openstack-cloud-controller-manager
   namespace: syn-cloud-provider-openstack
 spec:
@@ -22,7 +22,7 @@ spec:
         checksum/config: b0b31d6311d187dd53758033396c83505652c1ec8a62bef0b9afe7f9572f8db4
       labels:
         app: openstack-cloud-controller-manager
-        chart: openstack-cloud-controller-manager-2.36.1
+        chart: openstack-cloud-controller-manager-2.36.3
         component: controllermanager
         heritage: Helm
         release: openstack-ccm
diff --git a/tests/golden/defaults/cloud-provider-openstack/cloud-provider-openstack/10_ccm_helm_chart/openstack-cloud-controller-manager/templates/role.yaml b/tests/golden/defaults/cloud-provider-openstack/cloud-provider-openstack/10_ccm_helm_chart/openstack-cloud-controller-manager/templates/role.yaml
new file mode 100644
index 0000000..cf8ef1e
--- /dev/null
+++ b/tests/golden/defaults/cloud-provider-openstack/cloud-provider-openstack/10_ccm_helm_chart/openstack-cloud-controller-manager/templates/role.yaml
@@ -0,0 +1,23 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  annotations: null
+  labels:
+    app.kubernetes.io/instance: openstack-ccm
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: openstack-cloud-controller-manager
+    app.kubernetes.io/version: v1.36.0
+    helm.sh/chart: openstack-cloud-controller-manager-2.36.3
+  name: system:cloud-controller-manager:secret-reader
+  namespace: syn-cloud-provider-openstack
+rules:
+  - apiGroups:
+      - ''
+    resourceNames:
+      - cloud-config
+    resources:
+      - secrets
+    verbs:
+      - get
+      - list
+      - watch
diff --git a/tests/golden/defaults/cloud-provider-openstack/cloud-provider-openstack/10_ccm_helm_chart/openstack-cloud-controller-manager/templates/rolebinding.yaml b/tests/golden/defaults/cloud-provider-openstack/cloud-provider-openstack/10_ccm_helm_chart/openstack-cloud-controller-manager/templates/rolebinding.yaml
new file mode 100644
index 0000000..5a4ae4b
--- /dev/null
+++ b/tests/golden/defaults/cloud-provider-openstack/cloud-provider-openstack/10_ccm_helm_chart/openstack-cloud-controller-manager/templates/rolebinding.yaml
@@ -0,0 +1,20 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  annotations: null
+  labels:
+    app.kubernetes.io/instance: openstack-ccm
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: openstack-cloud-controller-manager
+    app.kubernetes.io/version: v1.36.0
+    helm.sh/chart: openstack-cloud-controller-manager-2.36.3
+  name: system:cloud-controller-manager:secret-reader
+  namespace: syn-cloud-provider-openstack
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: system:cloud-controller-manager:secret-reader
+subjects:
+  - kind: ServiceAccount
+    name: cloud-controller-manager
+    namespace: syn-cloud-provider-openstack
diff --git a/tests/golden/defaults/cloud-provider-openstack/cloud-provider-openstack/10_ccm_helm_chart/openstack-cloud-controller-manager/templates/serviceaccount.yaml b/tests/golden/defaults/cloud-provider-openstack/cloud-provider-openstack/10_ccm_helm_chart/openstack-cloud-controller-manager/templates/serviceaccount.yaml
index fd67e06..a6dcc9c 100644
--- a/tests/golden/defaults/cloud-provider-openstack/cloud-provider-openstack/10_ccm_helm_chart/openstack-cloud-controller-manager/templates/serviceaccount.yaml
+++ b/tests/golden/defaults/cloud-provider-openstack/cloud-provider-openstack/10_ccm_helm_chart/openstack-cloud-controller-manager/templates/serviceaccount.yaml
@@ -7,6 +7,6 @@ metadata:
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: openstack-cloud-controller-manager
     app.kubernetes.io/version: v1.36.0
-    helm.sh/chart: openstack-cloud-controller-manager-2.36.1
+    helm.sh/chart: openstack-cloud-controller-manager-2.36.3
   name: cloud-controller-manager
   namespace: syn-cloud-provider-openstack