fix(box): grant box-controller update/patch on services for deploy cutover

[afthabvp]

Problem

The box-controller ClusterRole (templates/box-rbac.yaml) grants services: [get, list, create, delete], but the deploy Service-selector cutover (SetServiceSelector) issues an UPDATE/PATCH on box-deploy-svc-<app>. Without update/patch it's forbidden, so on a redeploy the Service selector never moves to the new release-id → the published app keeps serving the old release (or 404s). The box logs this on every deploy:

ERROR deploy: failed to cut Service over to new release …
  cannot update resource "services" … in namespace "box-sandboxes" (forbidden)

(#137 added update/patch for apps/deployments but missed services.)

Fix

Add update,patch to the services rule. Chart 0.95.1 → 0.95.2.

Verified live

Reproduced on self-hosted: first deploy serves (Service is created with the right selector), but the cutover UPDATE is denied — confirmed via the box deploy logs above.

🤖 Generated with Claude Code

Summary by CodeRabbit

• New Features
  • Expanded application permissions to allow updating and partially editing existing services during deployment traffic cutovers.
• Chores
  • Bumped the Helm chart version and app version from 0.97.0 to 0.98.0.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: bb351ac6-6bd8-414a-8853-31a53d52d1d3

📥 Commits

Reviewing files that changed from the base of the PR and between 56aae78 and 58167de.

📒 Files selected for processing (1)

• charts/multiwoven/Chart.yaml

---

📝 Walkthrough

Walkthrough

The Helm chart version and appVersion were bumped to 0.98.0, and the box controller’s services RBAC rule now includes update and patch verbs.

Changes

Service-selector cutover

Layer / File(s)	Summary
Chart version bump charts/multiwoven/Chart.yaml	The Helm chart version and appVersion change from 0.97.0 to 0.98.0.
Service verbs update charts/multiwoven/templates/box-rbac.yaml	The services ClusterRole rule adds update and patch to the existing verb set.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Possibly related PRs

• Multiwoven/helm-charts#123: Modifies the same charts/multiwoven/templates/box-rbac.yaml RBAC template and is directly related to box controller permission changes.
• Multiwoven/helm-charts#137: Also changes charts/multiwoven/templates/box-rbac.yaml ClusterRole rules for the box controller.

Suggested reviewers

• hassimnaseef
• subintp

Poem

A rabbit hopped through chart and scheme,
Bumped the release to a brighter gleam.
With patch and update in its paws,
It tweaked the Services with tidy claws.
🐇

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the main RBAC change enabling box-controller to update and patch Services for deploy cutover.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch afthab/box-controller-services-rbac

---

_{Comment @coderabbitai help to get the list of available commands.}