Update release images

Fix kubernetes chart post-rendering
Add basic topologySpreadConstraints
2026-01-29 18:19:00 +00:00 · 2024-05-06 13:51:30 +02:00 · 2024-05-06 13:42:11 +02:00 · 2024-05-06 12:58:33 +02:00 · 2024-05-06 12:58:32 +02:00
465 changed files with 58486 additions and 48636 deletions
--- a/4
+++ b/4
@@ -3,8 +3,6 @@
 build:
 	make -C packages/apps/http-cache image
 	make -C packages/apps/kubernetes image
-	make -C packages/system/cilium image
-	make -C packages/system/kubeovn image
 	make -C packages/system/dashboard image
 	make -C packages/core/installer image
 	make manifests
@@ -22,4 +20,4 @@ repos:
 	make -C packages/extra repo

 assets:
-	make -C packages/core/installer/ assets
+	make -C packages/core/talos/ assets
--- a/hack/e2e.sh
+++ b/hack/e2e.sh
@@ -1,318 +0,0 @@
-#!/bin/bash
-if [ "$COZYSTACK_INSTALLER_YAML" = "" ]; then
-  echo 'COZYSTACK_INSTALLER_YAML variable is not set!' >&2
-  echo 'please set it with following command:' >&2
-  echo >&2
-  echo 'export COZYSTACK_INSTALLER_YAML=$(helm template -n cozy-system installer packages/core/installer)' >&2
-  echo >&2
-  exit 1
-fi
-
-if [ "$(cat /proc/sys/net/ipv4/ip_forward)" != 1 ]; then
-  echo "IPv4 forwarding is not enabled!" >&2
-  echo 'please enable forwarding with the following command:' >&2
-  echo >&2
-  echo 'echo 1 > /proc/sys/net/ipv4/ip_forward' >&2
-  echo >&2
-  exit 1
-fi
-
-set -x
-set -e
-
-kill `cat srv1/qemu.pid srv2/qemu.pid srv3/qemu.pid` || true
-
-ip link del cozy-br0 || true
-ip link add cozy-br0 type bridge
-ip link set cozy-br0 up
-ip addr add 192.168.123.1/24 dev cozy-br0
-
-# Enable forward & masquerading
-echo 1 > /proc/sys/net/ipv4/ip_forward
-iptables -t nat -A POSTROUTING -s 192.168.123.0/24 -j MASQUERADE
-
-rm -rf srv1 srv2 srv3
-mkdir -p srv1 srv2 srv3
-
-# Prepare cloud-init
-for i in 1 2 3; do
-  echo "local-hostname: srv$i" > "srv$i/meta-data"
-  echo '#cloud-config' > "srv$i/user-data"
-  cat > "srv$i/network-config" <<EOT
-version: 2
-ethernets:
-  eth0:
-    dhcp4: false
-    addresses:
-      - "192.168.123.1$i/26"
-    gateway4: "192.168.123.1"
-    nameservers:
-      search: [cluster.local]
-      addresses: [8.8.8.8]
-EOT
-
-  ( cd srv$i && genisoimage \
-      -output seed.img \
-      -volid cidata -rational-rock -joliet \
-      user-data meta-data network-config
-  )
-done
-
-# Prepare system drive
-if [ ! -f nocloud-amd64.raw ]; then
-  wget https://github.com/aenix-io/cozystack/releases/latest/download/nocloud-amd64.raw.xz -O nocloud-amd64.raw.xz
-  rm -f nocloud-amd64.raw
-  xz --decompress nocloud-amd64.raw.xz
-fi
-for i in 1 2 3; do
-  cp nocloud-amd64.raw srv$i/system.img
-  qemu-img resize srv$i/system.img 20G
-done
-
-# Prepare data drives
-for i in 1 2 3; do
-  qemu-img create srv$i/data.img 100G
-done
-
-# Prepare networking
-for i in 1 2 3; do
-  ip link del cozy-srv$i || true
-  ip tuntap add dev cozy-srv$i mode tap
-  ip link set cozy-srv$i up
-  ip link set cozy-srv$i master cozy-br0
-done
-
-# Start VMs
-for i in 1 2 3; do
-  qemu-system-x86_64 -machine type=pc,accel=kvm -cpu host -smp 4 -m 8192 \
-    -device virtio-net,netdev=net0,mac=52:54:00:12:34:5$i -netdev tap,id=net0,ifname=cozy-srv$i,script=no,downscript=no \
-    -drive file=srv$i/system.img,if=virtio,format=raw \
-    -drive file=srv$i/seed.img,if=virtio,format=raw \
-    -drive file=srv$i/data.img,if=virtio,format=raw \
-    -display none -daemonize -pidfile srv$i/qemu.pid
-done
-
-sleep 5
-
-# Wait for VM to start up
-timeout 60 sh -c 'until nc -nzv 192.168.123.11 50000 && nc -nzv 192.168.123.12 50000 && nc -nzv 192.168.123.13 50000; do sleep 1; done'
-
-cat > patch.yaml <<\EOT
-machine:
-  kubelet:
-    nodeIP:
-      validSubnets:
-      - 192.168.123.0/24
-    extraConfig:
-      maxPods: 512
-  kernel:
-    modules:
-    - name: openvswitch
-    - name: drbd
-      parameters:
-        - usermode_helper=disabled
-    - name: zfs
-    - name: spl
-  install:
-    image: ghcr.io/aenix-io/cozystack/talos:v1.7.1
-  files:
-  - content: |
-      [plugins]
-        [plugins."io.containerd.grpc.v1.cri"]
-          device_ownership_from_security_context = true      
-    path: /etc/cri/conf.d/20-customization.part
-    op: create
-
-cluster:
-  network:
-    cni:
-      name: none
-    dnsDomain: cozy.local
-    podSubnets:
-    - 10.244.0.0/16
-    serviceSubnets:
-    - 10.96.0.0/16
-EOT
-
-cat > patch-controlplane.yaml <<\EOT
-machine:
-  network:
-    interfaces:
-    - interface: eth0
-      vip:
-        ip: 192.168.123.10
-cluster:
-  allowSchedulingOnControlPlanes: true
-  controllerManager:
-    extraArgs:
-      bind-address: 0.0.0.0
-  scheduler:
-    extraArgs:
-      bind-address: 0.0.0.0
-  apiServer:
-    certSANs:
-    - 127.0.0.1
-  proxy:
-    disabled: true
-  discovery:
-    enabled: false
-  etcd:
-    advertisedSubnets:
-    - 192.168.123.0/24
-EOT
-
-# Gen configuration
-if [ ! -f secrets.yaml ]; then
-  talosctl gen secrets
-fi
-
-rm -f controlplane.yaml worker.yaml talosconfig kubeconfig
-talosctl gen config --with-secrets secrets.yaml cozystack https://192.168.123.10:6443 --config-patch=@patch.yaml --config-patch-control-plane @patch-controlplane.yaml
-export TALOSCONFIG=$PWD/talosconfig
-
-# Apply configuration
-talosctl apply -f controlplane.yaml -n 192.168.123.11 -e 192.168.123.11 -i
-talosctl apply -f controlplane.yaml -n 192.168.123.12 -e 192.168.123.12 -i
-talosctl apply -f controlplane.yaml -n 192.168.123.13 -e 192.168.123.13 -i
-
-# Wait for VM to be configured
-timeout 60 sh -c 'until nc -nzv 192.168.123.11 50000 && nc -nzv 192.168.123.12 50000 && nc -nzv 192.168.123.13 50000; do sleep 1; done'
-
-# Bootstrap
-talosctl bootstrap -n 192.168.123.11 -e 192.168.123.11
-
-# Wait for etcd
-timeout 120 sh -c 'while talosctl etcd members -n 192.168.123.11,192.168.123.12,192.168.123.13 -e 192.168.123.10 2>&1 | grep "rpc error"; do sleep 1; done'
-
-rm -f kubeconfig
-talosctl kubeconfig kubeconfig -e 192.168.123.10 -n 192.168.123.10
-export KUBECONFIG=$PWD/kubeconfig
-
-# Wait for kubernetes nodes appear
-timeout 60 sh -c 'until [ $(kubectl get node -o name | wc -l) = 3 ]; do sleep 1; done'
-kubectl create ns cozy-system
-kubectl create -f - <<\EOT
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: cozystack
-  namespace: cozy-system
-data:
-  bundle-name: "paas-full"
-  ipv4-pod-cidr: "10.244.0.0/16"
-  ipv4-pod-gateway: "10.244.0.1"
-  ipv4-svc-cidr: "10.96.0.0/16"
-  ipv4-join-cidr: "100.64.0.0/16"
-EOT
-
-#
-echo "$COZYSTACK_INSTALLER_YAML" | kubectl apply -f -
-
-# wait for cozystack pod to start
-kubectl wait deploy  --timeout=1m --for=condition=available -n cozy-system cozystack
-
-# wait for helmreleases appear
-timeout 60 sh -c 'until kubectl get hr -A | grep cozy; do sleep 1; done'
-
-sleep 5
-
-kubectl get hr -A | awk 'NR>1 {print "kubectl wait --timeout=15m --for=condition=ready -n " $1 " hr/" $2 " &"} END{print "wait"}' | sh -x
-# Wait for linstor controller
-kubectl wait deploy --timeout=5m --for=condition=available -n cozy-linstor linstor-controller
-
-# Wait for all linstor nodes become Online
-timeout 60 sh -c 'until [ $(kubectl exec -n cozy-linstor deploy/linstor-controller -- linstor node list | grep -c Online) = 3 ]; do sleep 1; done'
-
-kubectl exec -n cozy-linstor deploy/linstor-controller -- linstor ps cdp zfs srv1 /dev/vdc --pool-name data --storage-pool data
-kubectl exec -n cozy-linstor deploy/linstor-controller -- linstor ps cdp zfs srv2 /dev/vdc --pool-name data --storage-pool data
-kubectl exec -n cozy-linstor deploy/linstor-controller -- linstor ps cdp zfs srv3 /dev/vdc --pool-name data --storage-pool data
-
-kubectl create -f- <<EOT
---
-apiVersion: storage.k8s.io/v1
-kind: StorageClass
-metadata:
-  name: local
-  annotations:
-    storageclass.kubernetes.io/is-default-class: "true"
-provisioner: linstor.csi.linbit.com
-parameters:
-  linstor.csi.linbit.com/storagePool: "data"
-  linstor.csi.linbit.com/layerList: "storage"
-  linstor.csi.linbit.com/allowRemoteVolumeAccess: "false"
-volumeBindingMode: WaitForFirstConsumer
-allowVolumeExpansion: true
---
-apiVersion: storage.k8s.io/v1
-kind: StorageClass
-metadata:
-  name: replicated
-provisioner: linstor.csi.linbit.com
-parameters:
-  linstor.csi.linbit.com/storagePool: "data"
-  linstor.csi.linbit.com/autoPlace: "3"
-  linstor.csi.linbit.com/layerList: "drbd storage"
-  linstor.csi.linbit.com/allowRemoteVolumeAccess: "true"
-  property.linstor.csi.linbit.com/DrbdOptions/auto-quorum: suspend-io
-  property.linstor.csi.linbit.com/DrbdOptions/Resource/on-no-data-accessible: suspend-io
-  property.linstor.csi.linbit.com/DrbdOptions/Resource/on-suspended-primary-outdated: force-secondary
-  property.linstor.csi.linbit.com/DrbdOptions/Net/rr-conflict: retry-connect
-volumeBindingMode: WaitForFirstConsumer
-allowVolumeExpansion: true
-EOT
-kubectl create -f- <<EOT
---
-apiVersion: metallb.io/v1beta1
-kind: L2Advertisement
-metadata:
-  name: cozystack
-  namespace: cozy-metallb
-spec:
-  ipAddressPools:
-  - cozystack
---
-apiVersion: metallb.io/v1beta1
-kind: IPAddressPool
-metadata:
-  name: cozystack
-  namespace: cozy-metallb
-spec:
-  addresses:
-  - 192.168.123.200-192.168.123.250
-  autoAssign: true
-  avoidBuggyIPs: false
-EOT
-
-kubectl patch -n tenant-root hr/tenant-root --type=merge -p '{"spec":{ "values":{
-  "host": "example.org",
-  "ingress": true,
-  "monitoring": true,
-  "etcd": true
-}}}'
-
-# Wait for HelmRelease be created
-timeout 60 sh -c 'until kubectl get hr -n tenant-root etcd ingress monitoring tenant-root; do sleep 1; done'
-
-# Wait for HelmReleases be installed
-kubectl wait --timeout=2m --for=condition=ready -n tenant-root hr etcd ingress monitoring tenant-root
-
-# Wait for nginx-ingress-controller
-timeout 60 sh -c 'until kubectl get deploy -n tenant-root root-ingress-controller; do sleep 1; done'
-kubectl wait --timeout=5m --for=condition=available -n tenant-root deploy root-ingress-controller
-
-# Wait for etcd
-kubectl wait --timeout=5m --for=jsonpath=.status.readyReplicas=3 -n tenant-root sts etcd
-
-# Wait for Victoria metrics
-kubectl wait --timeout=5m --for=condition=available deploy -n tenant-root vmalert-vmalert vminsert-longterm vminsert-shortterm
-kubectl wait --timeout=5m --for=jsonpath=.status.readyReplicas=2 -n tenant-root sts vmalertmanager-alertmanager vmselect-longterm vmselect-shortterm vmstorage-longterm vmstorage-shortterm
-
-# Wait for grafana
-kubectl wait --timeout=5m --for=condition=ready -n tenant-root clusters.postgresql.cnpg.io grafana-db
-kubectl wait --timeout=5m --for=condition=available -n tenant-root deploy grafana-deployment 
-
-# Get IP of nginx-ingress
-ip=$(kubectl get svc -n tenant-root root-ingress-controller -o jsonpath='{.status.loadBalancer.ingress..ip}')
-
-# Check Grafana
-curl -sS -k "https://$ip" -H 'Host: grafana.example.org' | grep Found
--- a/manifests/cozystack-installer.yaml
+++ b/manifests/cozystack-installer.yaml
@@ -54,11 +54,6 @@ spec:
  selector:
    matchLabels:
      app: cozystack
-  strategy:
-    type: RollingUpdate
-    rollingUpdate:
-      maxSurge: 0
-      maxUnavailable: 1
  template:
    metadata:
      labels:
@@ -68,7 +63,7 @@ spec:
      serviceAccountName: cozystack
      containers:
      - name: cozystack
-        image: "ghcr.io/aenix-io/cozystack/cozystack:v0.9.1"
+        image: "ghcr.io/aenix-io/cozystack/cozystack:v0.4.0"
        env:
        - name: KUBERNETES_SERVICE_HOST
          value: localhost
@@ -87,7 +82,7 @@ spec:
            fieldRef:
              fieldPath: metadata.name
      - name: darkhttpd
-        image: "ghcr.io/aenix-io/cozystack/cozystack:v0.9.1"
+        image: "ghcr.io/aenix-io/cozystack/cozystack:v0.4.0"
        command:
        - /usr/bin/darkhttpd
        - /cozystack/assets
--- a/packages/apps/Makefile
+++ b/packages/apps/Makefile
@@ -11,7 +11,7 @@ repo:
 	rm -rf "$(TMP)"

 fix-chartnames:
-	find . -maxdepth 2 -name Chart.yaml  | awk -F/ '{print $$2}' | while read i; do sed -i "s/^name: .*/name: $$i/" "$$i/Chart.yaml"; done
+	find . -name Chart.yaml -maxdepth 2 | awk -F/ '{print $$2}' | while read i; do sed -i "s/^name: .*/name: $$i/" "$$i/Chart.yaml"; done

 gen-versions-map: fix-chartnames
 	../../hack/gen_versions_map.sh
--- a/packages/apps/clickhouse/Chart.yaml
+++ b/packages/apps/clickhouse/Chart.yaml
@@ -16,7 +16,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.2.1
+version: 0.2.0

 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
--- a/packages/apps/clickhouse/Makefile
+++ b/packages/apps/clickhouse/Makefile
@@ -1,2 +0,0 @@
-generate:
-	readme-generator -v values.yaml -s values.schema.json -r README.md
--- a/packages/apps/clickhouse/README.md
+++ b/packages/apps/clickhouse/README.md
@@ -1,17 +0,0 @@
-# Managed Clickhouse Service
-
-## Parameters
-
-### Common parameters
-
-| Name       | Description                   | Value  |
-| ---------- | ----------------------------- | ------ |
-| `size`     | Persistent Volume size        | `10Gi` |
-| `shards`   | Number of Clickhouse replicas | `1`    |
-| `replicas` | Number of Clickhouse shards   | `2`    |
-
-### Configuration parameters
-
-| Name    | Description         | Value |
-| ------- | ------------------- | ----- |
-| `users` | Users configuration | `{}`  |
--- a/packages/apps/clickhouse/templates/clickhouse.yaml
+++ b/packages/apps/clickhouse/templates/clickhouse.yaml
@@ -14,7 +14,6 @@ spec:
      {{- range $name, $u := . }}
      {{ $name }}/password_sha256_hex: {{ sha256sum $u.password }}
      {{ $name }}/profile: {{ ternary "readonly" "default" (index $u "readonly" | default false) }}
-      {{ $name }}/networks/ip: ["::/0"]
      {{- end }}
    {{- end }}
    profiles:
--- a/packages/apps/clickhouse/values.schema.json
+++ b/packages/apps/clickhouse/values.schema.json
@@ -1,21 +0,0 @@
-{
-    "title": "Chart Values",
-    "type": "object",
-    "properties": {
-        "size": {
-            "type": "string",
-            "description": "Persistent Volume size",
-            "default": "10Gi"
-        },
-        "shards": {
-            "type": "number",
-            "description": "Number of Clickhouse replicas",
-            "default": 1
-        },
-        "replicas": {
-            "type": "number",
-            "description": "Number of Clickhouse shards",
-            "default": 2
-        }
-    }
-}
--- a/packages/apps/clickhouse/values.yaml
+++ b/packages/apps/clickhouse/values.yaml
@@ -1,22 +1,10 @@
-## @section Common parameters
-
-## @param size Persistent Volume size
-## @param shards Number of Clickhouse replicas
-## @param replicas Number of Clickhouse shards
-##
 size: 10Gi
 shards: 1
 replicas: 2

-## @section Configuration parameters
-
-## @param users [object] Users configuration
-## Example:
-## users:
-##   user1:
-##     password: strongpassword
-##   user2:
-##     readonly: true
-##     password: hackme
-##
-users: {}
+users:
+  user1:
+    password: strongpassword
+  user2:
+    readonly: true
+    password: hackme
--- a/packages/apps/http-cache/Makefile
+++ b/packages/apps/http-cache/Makefile
@@ -16,9 +16,6 @@ image-nginx:
 		--load=$(LOAD)
 	echo "$(REGISTRY)/nginx-cache:$(call settag,$(NGINX_CACHE_TAG))" > images/nginx-cache.tag

-generate:
-	readme-generator -v values.yaml -s values.schema.json -r README.md
-
 update:
 	tag=$$(git ls-remote --tags --sort="v:refname" https://github.com/chrislim2888/IP2Location-C-Library | awk -F'[/^]' 'END{print $$3}') && \
 	sed -i "/^ARG IP2LOCATION_C_VERSION=/ s/=.*/=$$tag/" images/nginx/Dockerfile
--- a/packages/apps/http-cache/README.md
+++ b/packages/apps/http-cache/README.md
@@ -55,20 +55,3 @@ The deployment architecture is illustrated in the diagram below:

 VTS module shows wrong upstream resonse time
 - https://github.com/vozlt/nginx-module-vts/issues/198
-
-## Parameters
-
-### Common parameters
-
-| Name               | Description                                     | Value   |
-| ------------------ | ----------------------------------------------- | ------- |
-| `external`         | Enable external access from outside the cluster | `false` |
-| `size`             | Persistent Volume size                          | `10Gi`  |
-| `haproxy.replicas` | Number of HAProxy replicas                      | `2`     |
-| `nginx.replicas`   | Number of Nginx replicas                        | `2`     |
-
-### Configuration parameters
-
-| Name        | Description             | Value |
-| ----------- | ----------------------- | ----- |
-| `endpoints` | Endpoints configuration | `[]`  |
--- a/packages/apps/http-cache/images/nginx-cache.json
+++ b/packages/apps/http-cache/images/nginx-cache.json
@@ -1,48 +1,4 @@
 {
-  "buildx.build.provenance": {
-    "buildType": "https://mobyproject.org/buildkit@v1",
-    "materials": [
-      {
-        "uri": "pkg:docker/ubuntu@22.04?platform=linux%2Famd64",
-        "digest": {
-          "sha256": "340d9b015b194dc6e2a13938944e0d016e57b9679963fdeb9ce021daac430221"
-        }
-      }
-    ],
-    "invocation": {
-      "configSource": {
-        "entryPoint": "Dockerfile"
-      },
-      "parameters": {
-        "frontend": "dockerfile.v0",
-        "args": {
-          "build-arg:ARCH": "amd64"
-        },
-        "locals": [
-          {
-            "name": "context"
-          },
-          {
-            "name": "dockerfile"
-          }
-        ]
-      },
-      "environment": {
-        "platform": "linux/amd64"
-      }
-    }
-  },
-  "buildx.build.ref": "priceless_leavitt/priceless_leavitt0/q6c6lcwah1m8gj7fxrdn94eaz",
-  "containerimage.config.digest": "sha256:304f57018d29e52d00cfc8c35e1d5112eeb3d85f0056de5112baab79748528ab",
-  "containerimage.descriptor": {
-    "mediaType": "application/vnd.docker.distribution.manifest.v2+json",
-    "digest": "sha256:7d2554ce0a988672ceab3d3a7a504a06ca30d5ccb1de0b677871169147b3130e",
-    "size": 1094,
-    "platform": {
-      "architecture": "amd64",
-      "os": "linux"
-    }
-  },
-  "containerimage.digest": "sha256:7d2554ce0a988672ceab3d3a7a504a06ca30d5ccb1de0b677871169147b3130e",
-  "image.name": "ghcr.io/aenix-io/cozystack/nginx-cache:v0.1.0,ghcr.io/aenix-io/cozystack/nginx-cache:v0.1.0-v0.9.1"
+  "containerimage.config.digest": "sha256:9eb68d2d503d7e22afc6fde2635f566fd3456bbdb3caad5dc9f887be1dc2b8ab",
+  "containerimage.digest": "sha256:1f44274dbc2c3be2a98e6cef83d68a041ae9ef31abb8ab069a525a2a92702bdd"
 }
--- a/packages/apps/http-cache/values.schema.json
+++ b/packages/apps/http-cache/values.schema.json
@@ -1,42 +0,0 @@
-{
-    "title": "Chart Values",
-    "type": "object",
-    "properties": {
-        "external": {
-            "type": "boolean",
-            "description": "Enable external access from outside the cluster",
-            "default": false
-        },
-        "size": {
-            "type": "string",
-            "description": "Persistent Volume size",
-            "default": "10Gi"
-        },
-        "haproxy": {
-            "type": "object",
-            "properties": {
-                "replicas": {
-                    "type": "number",
-                    "description": "Number of HAProxy replicas",
-                    "default": 2
-                }
-            }
-        },
-        "nginx": {
-            "type": "object",
-            "properties": {
-                "replicas": {
-                    "type": "number",
-                    "description": "Number of Nginx replicas",
-                    "default": 2
-                }
-            }
-        },
-        "endpoints": {
-            "type": "array",
-            "description": "Endpoints configuration",
-            "default": [],
-            "items": {}
-        }
-    }
-}
--- a/packages/apps/http-cache/values.yaml
+++ b/packages/apps/http-cache/values.yaml
@@ -1,28 +1,15 @@
-
-## @section Common parameters
-
-## @param external Enable external access from outside the cluster
-## @param size Persistent Volume size
-## @param haproxy.replicas Number of HAProxy replicas
-## @param nginx.replicas Number of Nginx replicas
-##
 external: false
-size: 10Gi
+
 haproxy:
  replicas: 2
 nginx:
  replicas: 2

-## @section Configuration parameters
-
-## @param endpoints Endpoints configuration
-## Example:
-## endpoints:
-##   - 10.100.3.1:80
-##   - 10.100.3.11:80
-##   - 10.100.3.2:80
-##   - 10.100.3.12:80
-##   - 10.100.3.3:80
-##   - 10.100.3.13:80
-##
-endpoints: []
+size: 10Gi
+endpoints:
+  - 10.100.3.1:80
+  - 10.100.3.11:80
+  - 10.100.3.2:80
+  - 10.100.3.12:80
+  - 10.100.3.3:80
+  - 10.100.3.13:80
--- a/packages/apps/kafka/Chart.yaml
+++ b/packages/apps/kafka/Chart.yaml
@@ -16,7 +16,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.2.1
+version: 0.1.0

 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
--- a/packages/apps/kafka/Makefile
+++ b/packages/apps/kafka/Makefile
@@ -1,2 +0,0 @@
-generate:
-	readme-generator -v values.yaml -s values.schema.json -r README.md
--- a/packages/apps/kafka/README.md
+++ b/packages/apps/kafka/README.md
@@ -1,19 +0,0 @@
-# Managed Kafka Service
-
-## Parameters
-
-### Common parameters
-
-| Name                 | Description                                     | Value   |
-| -------------------- | ----------------------------------------------- | ------- |
-| `external`           | Enable external access from outside the cluster | `false` |
-| `kafka.size`         | Persistent Volume size for Kafka                | `10Gi`  |
-| `kafka.replicas`     | Number of Kafka replicas                        | `3`     |
-| `zookeeper.size`     | Persistent Volume size for ZooKeeper            | `5Gi`   |
-| `zookeeper.replicas` | Number of ZooKeeper replicas                    | `3`     |
-
-### Configuration parameters
-
-| Name     | Description          | Value |
-| -------- | -------------------- | ----- |
-| `topics` | Topics configuration | `[]`  |
--- a/packages/apps/kafka/templates/kafka.yaml
+++ b/packages/apps/kafka/templates/kafka.yaml
@@ -7,7 +7,7 @@ metadata:
    app.kubernetes.io/managed-by: {{ .Release.Service }}
 spec:
  kafka:
-    replicas: {{ .Values.kafka.replicas }}
+    replicas: {{ .Values.replicas }}
    listeners:
      - name: plain
        port: 9092
@@ -41,7 +41,7 @@ spec:
        {{- end }}
        deleteClaim: true
  zookeeper:
-    replicas: {{ .Values.zookeeper.replicas }}
+    replicas: {{ .Values.replicas }}
    storage:
      type: persistent-claim
      {{- with .Values.zookeeper.size }}
--- a/packages/apps/kafka/templates/topics.yaml
+++ b/packages/apps/kafka/templates/topics.yaml
@@ -8,12 +8,8 @@ metadata:
    strimzi.io/cluster: "{{ $.Release.Name }}"
 spec:
  topicName: "{{ $topic.name }}"
-  {{- with $topic.partitions }}
-  partitions: "{{ . }}"
-  {{- end }}
-  {{- with $topic.replicas }}
-  replicas: "{{ . }}"
-  {{- end }}
+  partitions: 10
+  replicas: 3
  {{- with $topic.config }}
  config:
    {{- toYaml . | nindent 4 }}
--- a/packages/apps/kafka/values.schema.json
+++ b/packages/apps/kafka/values.schema.json
@@ -1,47 +0,0 @@
-{
-    "title": "Chart Values",
-    "type": "object",
-    "properties": {
-        "external": {
-            "type": "boolean",
-            "description": "Enable external access from outside the cluster",
-            "default": false
-        },
-        "kafka": {
-            "type": "object",
-            "properties": {
-                "size": {
-                    "type": "string",
-                    "description": "Persistent Volume size for Kafka",
-                    "default": "10Gi"
-                },
-                "replicas": {
-                    "type": "number",
-                    "description": "Number of Kafka replicas",
-                    "default": 3
-                }
-            }
-        },
-        "zookeeper": {
-            "type": "object",
-            "properties": {
-                "size": {
-                    "type": "string",
-                    "description": "Persistent Volume size for ZooKeeper",
-                    "default": "5Gi"
-                },
-                "replicas": {
-                    "type": "number",
-                    "description": "Number of ZooKeeper replicas",
-                    "default": 3
-                }
-            }
-        },
-        "topics": {
-            "type": "array",
-            "description": "Topics configuration",
-            "default": [],
-            "items": {}
-        }
-    }
-}
--- a/packages/apps/kafka/values.yaml
+++ b/packages/apps/kafka/values.yaml
@@ -1,12 +1,3 @@
-
-## @section Common parameters
-
-## @param external Enable external access from outside the cluster
-## @param kafka.size Persistent Volume size for Kafka
-## @param kafka.replicas Number of Kafka replicas
-## @param zookeeper.size Persistent Volume size for ZooKeeper
-## @param zookeeper.replicas Number of ZooKeeper replicas
-##
 external: false
 kafka:
  size: 10Gi
@@ -15,23 +6,17 @@ zookeeper:
  size: 5Gi
  replicas: 3

-## @section Configuration parameters
-
-## @param topics Topics configuration
-## Example:
-## topics:
-##   - name: Results
-##     partitions: 1
-##     replicas: 3
-##     config:
-##       min.insync.replicas: 2
-##   - name: Orders
-##     config:
-##       cleanup.policy: compact
-##       segment.ms: 3600000
-##       max.compaction.lag.ms: 5400000
-##       min.insync.replicas: 2
-##     partitions: 1
-##     replicas: 3
-##
-topics: []
+topics:
+  - name: Results
+    partitions: 1
+    replicas: 3
+    config:
+      min.insync.replicas: 2
+  - name: Orders
+    config:
+      cleanup.policy: compact
+      segment.ms: 3600000
+      max.compaction.lag.ms: 5400000
+      min.insync.replicas: 2
+    partitions: 1
+    replicationFactor: 3
--- a/packages/apps/kubernetes/Chart.yaml
+++ b/packages/apps/kubernetes/Chart.yaml
@@ -16,10 +16,10 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.6.0
+version: 0.2.0

 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
 # follow Semantic Versioning. They should reflect the version the application is using.
 # It is recommended to use it with quotes.
-appVersion: "1.30.1"
+appVersion: "1.19.0"
--- a/packages/apps/kubernetes/Makefile
+++ b/packages/apps/kubernetes/Makefile
@@ -1,10 +1,7 @@
-UBUNTU_CONTAINER_DISK_TAG = v1.30.1
+UBUNTU_CONTAINER_DISK_TAG = v1.29.1

 include ../../../scripts/common-envs.mk

-generate:
-	readme-generator -v values.yaml -s values.schema.json -r README.md
-
 image: image-ubuntu-container-disk

 image-ubuntu-container-disk:
--- a/packages/apps/kubernetes/README.md
+++ b/packages/apps/kubernetes/README.md
@@ -26,23 +26,3 @@ How to access to deployed cluster:
 ```
 kubectl get secret -n <namespace> kubernetes-<clusterName>-admin-kubeconfig -o go-template='{{ printf "%s\n" (index .data "super-admin.conf" | base64decode) }}' > test
 ```
-
-## Parameters
-
-### Common parameters
-
-| Name                    | Description                                                                                                                            | Value |
-| ----------------------- | -------------------------------------------------------------------------------------------------------------------------------------- | ----- |
-| `host`                  | The hostname used to access the Kubernetes cluster externally (defaults to using the cluster name as a subdomain for the tenant host). | `""`  |
-| `controlPlane.replicas` | Number of replicas for Kubernetes contorl-plane components                                                                             | `2`   |
-| `nodeGroups`            | nodeGroups configuration                                                                                                               | `{}`  |
-
-### Cluster Addons
-
-| Name                          | Description                                                                        | Value   |
-| ----------------------------- | ---------------------------------------------------------------------------------- | ------- |
-| `addons.certManager.enabled`  | Enables the cert-manager                                                           | `false` |
-| `addons.ingressNginx.enabled` | Enable Ingress-NGINX controller (expect nodes with 'ingress-nginx' role)           | `false` |
-| `addons.ingressNginx.hosts`   | List of domain names that should be passed through to the cluster by upper cluster | `[]`    |
-| `addons.fluxcd.enabled`       | Enables Flux CD                                                                    | `false` |
-
--- a/packages/apps/kubernetes/images/ubuntu-container-disk.json
+++ b/packages/apps/kubernetes/images/ubuntu-container-disk.json
@@ -1,48 +1,4 @@
 {
-  "buildx.build.provenance": {
-    "buildType": "https://mobyproject.org/buildkit@v1",
-    "materials": [
-      {
-        "uri": "pkg:docker/ubuntu@22.04?platform=linux%2Famd64",
-        "digest": {
-          "sha256": "340d9b015b194dc6e2a13938944e0d016e57b9679963fdeb9ce021daac430221"
-        }
-      }
-    ],
-    "invocation": {
-      "configSource": {
-        "entryPoint": "Dockerfile"
-      },
-      "parameters": {
-        "frontend": "dockerfile.v0",
-        "args": {
-          "build-arg:ARCH": "amd64"
-        },
-        "locals": [
-          {
-            "name": "context"
-          },
-          {
-            "name": "dockerfile"
-          }
-        ]
-      },
-      "environment": {
-        "platform": "linux/amd64"
-      }
-    }
-  },
-  "buildx.build.ref": "priceless_leavitt/priceless_leavitt0/px2lfxfyhlqfufdvuvk6z8aek",
-  "containerimage.config.digest": "sha256:c144c5f12a47af7880ee5f056b14177c07b585b8ab1e68b7e7900e1c923083cf",
-  "containerimage.descriptor": {
-    "mediaType": "application/vnd.docker.distribution.manifest.v2+json",
-    "digest": "sha256:81caf89efe252ae2ca1990d08a3a314552d70ff36bcd4022b173c7150fbec805",
-    "size": 506,
-    "platform": {
-      "architecture": "amd64",
-      "os": "linux"
-    }
-  },
-  "containerimage.digest": "sha256:81caf89efe252ae2ca1990d08a3a314552d70ff36bcd4022b173c7150fbec805",
-  "image.name": "ghcr.io/aenix-io/cozystack/ubuntu-container-disk:v1.30.1,ghcr.io/aenix-io/cozystack/ubuntu-container-disk:v1.30.1-v0.9.1"
+  "containerimage.config.digest": "sha256:a7e8e6e35ac07bcf6253c9cfcf21fd3c315bd0653ad0427dd5f0cae95ffd3722",
+  "containerimage.digest": "sha256:c03bffeeb70fe7dd680d2eca3021d2405fbcd9961dd38437f5673560c31c72cc"
 }
--- a/packages/apps/kubernetes/images/ubuntu-container-disk.tag
+++ b/packages/apps/kubernetes/images/ubuntu-container-disk.tag
@@ -1 +1 @@
-ghcr.io/aenix-io/cozystack/ubuntu-container-disk:v1.30.1
+ghcr.io/aenix-io/cozystack/ubuntu-container-disk:v1.29.1
--- a/packages/apps/kubernetes/images/ubuntu-container-disk/Dockerfile
+++ b/packages/apps/kubernetes/images/ubuntu-container-disk/Dockerfile
@@ -26,8 +26,8 @@ RUN qemu-img resize image.img 5G \
 && guestfish --remote sh "curl -fsSL https://download.docker.com/linux/ubuntu/gpg | gpg --dearmor -o /etc/apt/keyrings/docker.gpg" \
 && guestfish --remote sh 'echo "deb [arch=amd64 signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable" | tee /etc/apt/sources.list.d/docker.list' \
 # kubernetes repo
- && guestfish --remote sh "curl -fsSL https://pkgs.k8s.io/core:/stable:/v1.30/deb/Release.key | gpg --dearmor -o /etc/apt/keyrings/kubernetes-apt-keyring.gpg" \
- && guestfish --remote sh "echo 'deb [signed-by=/etc/apt/keyrings/kubernetes-apt-keyring.gpg] https://pkgs.k8s.io/core:/stable:/v1.30/deb/ /' | tee /etc/apt/sources.list.d/kubernetes.list" \
+ && guestfish --remote sh "curl -fsSL https://pkgs.k8s.io/core:/stable:/v1.29/deb/Release.key | gpg --dearmor -o /etc/apt/keyrings/kubernetes-apt-keyring.gpg" \
+ && guestfish --remote sh "echo 'deb [signed-by=/etc/apt/keyrings/kubernetes-apt-keyring.gpg] https://pkgs.k8s.io/core:/stable:/v1.29/deb/ /' | tee /etc/apt/sources.list.d/kubernetes.list" \
 # install containerd
 && guestfish --remote command "apt-get update -y" \
 && guestfish --remote command "apt-get install -y containerd.io" \
--- a/packages/apps/kubernetes/templates/cluster.yaml
+++ b/packages/apps/kubernetes/templates/cluster.yaml
@@ -2,58 +2,6 @@
 {{- $etcd := index $myNS.metadata.annotations "namespace.cozystack.io/etcd" }}
 {{- $ingress := index $myNS.metadata.annotations "namespace.cozystack.io/ingress" }}
 {{- $host := index $myNS.metadata.annotations "namespace.cozystack.io/host" }}
-{{- $kubevirtmachinetemplateNames := list }}
-{{- define "kubevirtmachinetemplate" -}}
-spec:
-  virtualMachineBootstrapCheck:
-    checkStrategy: ssh
-  virtualMachineTemplate:
-    metadata:
-      namespace: {{ $.Release.Namespace }}
-      labels:
-        {{- range .group.roles }}
-        node-role.kubernetes.io/{{ . }}: ""
-        {{- end }}
-    spec:
-      runStrategy: Always
-      template:
-        spec:
-          domain:
-            cpu:
-              threads: 1
-              cores: {{ .group.resources.cpu }}
-              sockets: 1
-            devices:
-              disks:
-              - name: system
-                disk:
-                  bus: virtio
-                  pciAddress: 0000:07:00.0
-              - name: containerd
-                disk:
-                  bus: virtio
-                  pciAddress: 0000:08:00.0
-              - name: kubelet
-                disk:
-                  bus: virtio
-                  pciAddress: 0000:09:00.0
-              networkInterfaceMultiqueue: true
-            memory:
-              guest: {{ .group.resources.memory }}
-          evictionStrategy: External
-          volumes:
-          - name: system
-            containerDisk:
-              image: "{{ $.Files.Get "images/ubuntu-container-disk.tag" | trim }}@{{ index ($.Files.Get "images/ubuntu-container-disk.json" | fromJson) "containerimage.digest" }}"
-          - name: containerd
-            emptyDisk:
-              capacity: 20Gi
-          - name: kubelet
-            emptyDisk:
-              capacity: 20Gi
-{{- end }}
-
-
 ---
 apiVersion: cluster.x-k8s.io/v1beta1
 kind: Cluster
@@ -91,9 +39,7 @@ metadata:
 spec:
  dataStoreName: "{{ $etcd }}"
  addons:
-    coreDNS:
-      dnsServiceIPs:
-      - 10.95.0.10
+    coreDNS: {}
    konnectivity: {}
  kubelet:
    cgroupfs: systemd
@@ -109,7 +55,7 @@ spec:
      className: "{{ $ingress }}"
  deployment:
  replicas: 2
-  version: 1.30.1
+  version: 1.29.0
 ---
 apiVersion: infrastructure.cluster.x-k8s.io/v1alpha1
 kind: KubevirtCluster
@@ -128,21 +74,6 @@ metadata:
 spec:
  template:
    spec:
-      diskSetup:
-        filesystems:
-        - device: /dev/vdb
-          filesystem: xfs
-          label: containerd
-          partition: "none"
-        - device: /dev/vdc
-          filesystem: xfs
-          label: kubelet
-          partition: "none"
-      mounts:
-      - ["LABEL=containerd", "/var/lib/containerd"]
-      - ["LABEL=kubelet", "/var/lib/kubelet"]
-      preKubeadmCommands:
-      - sed -i 's|root:x:|root::|' /etc/passwd
      joinConfiguration:
        nodeRegistration:
          kubeletExtraArgs: {}
@@ -153,20 +84,41 @@ spec:
        skipPhases:
        - addon/kube-proxy
 ---
-{{- $context := deepCopy $ }}
-{{- $_ := set $context "group" $group }}
-{{- $kubevirtmachinetemplate := include "kubevirtmachinetemplate" $context }}
-{{- $kubevirtmachinetemplateHash := $kubevirtmachinetemplate | sha256sum | trunc 6 }}
-{{- $kubevirtmachinetemplateName := printf "%s-%s-%s" $.Release.Name $groupName $kubevirtmachinetemplateHash }}
-{{- $kubevirtmachinetemplateNames = append $kubevirtmachinetemplateNames $kubevirtmachinetemplateName }}
 apiVersion: infrastructure.cluster.x-k8s.io/v1alpha1
 kind: KubevirtMachineTemplate
 metadata:
-  name: {{ $.Release.Name }}-{{ $groupName }}-{{ $kubevirtmachinetemplateHash }}
+  name: {{ $.Release.Name }}-{{ $groupName }}
  namespace: {{ $.Release.Namespace }}
 spec:
  template:
-    {{- $kubevirtmachinetemplate | nindent 4 }}
+    spec:
+      virtualMachineBootstrapCheck:
+        checkStrategy: ssh
+      virtualMachineTemplate:
+        metadata:
+          namespace: {{ $.Release.Namespace }}
+        spec:
+          runStrategy: Always
+          template:
+            spec:
+              domain:
+                cpu:
+                  threads: 1
+                  cores: {{ $group.resources.cpu }}
+                  sockets: 1
+                devices:
+                  disks:
+                  - disk:
+                      bus: virtio
+                    name: containervolume
+                  networkInterfaceMultiqueue: true
+                memory:
+                  guest: {{ $group.resources.memory }}
+              evictionStrategy: External
+              volumes:
+              - containerDisk:
+                  image: "{{ $.Files.Get "images/ubuntu-container-disk.tag" | trim }}@{{ index ($.Files.Get "images/ubuntu-container-disk.json" | fromJson) "containerimage.digest" }}"
+                name: containervolume
 ---
 apiVersion: cluster.x-k8s.io/v1beta1
 kind: MachineDeployment
@@ -181,55 +133,18 @@ metadata:
 spec:
  clusterName: {{ $.Release.Name }}
  template:
-    metadata:
-      labels:
-        cluster.x-k8s.io/cluster-name: {{ $.Release.Name }}
-        cluster.x-k8s.io/deployment-name: {{ $.Release.Name }}-{{ $groupName }}
-        {{- range $group.roles }}
-        node-role.kubernetes.io/{{ . }}: ""
-        {{- end }}
    spec:
      bootstrap:
        configRef:
          apiVersion: bootstrap.cluster.x-k8s.io/v1beta1
          kind: KubeadmConfigTemplate
          name: {{ $.Release.Name }}-{{ $groupName }}
-          namespace: {{ $.Release.Namespace }}
+          namespace: default
      clusterName: {{ $.Release.Name }}
      infrastructureRef:
        apiVersion: infrastructure.cluster.x-k8s.io/v1alpha1
        kind: KubevirtMachineTemplate
-        name: {{ $.Release.Name }}-{{ $groupName }}-{{ $kubevirtmachinetemplateHash }}
+        name: {{ $.Release.Name }}-{{ $groupName }}
        namespace: default
-      version: v1.30.1
-{{- end }}
---
-{{- /*
-We must preserve all previous KubevirtMachineTemplates until a MachineSet references them.
-*/ -}}
-{{- $mss := (lookup "cluster.x-k8s.io/v1beta1" "MachineSet" $.Release.Namespace "").items }}
-{{- $oldKubevirtmachinetemplates := dict }}
-{{- range $kmt := (lookup "infrastructure.cluster.x-k8s.io/v1alpha1" "KubevirtMachineTemplate" .Release.Namespace "").items }}
-{{- range $or := $kmt.metadata.ownerReferences }}
-{{- if and (eq $or.kind "Cluster") (eq $or.name $.Release.Name) }}
-{{- range $ms := $mss }}
-{{- if and (eq $ms.spec.template.spec.infrastructureRef.kind "KubevirtMachineTemplate") (eq $ms.spec.template.spec.infrastructureRef.name $kmt.metadata.name) }}
-{{- if not (has $kmt.metadata.name $kubevirtmachinetemplateNames) }}
-{{- $oldKubevirtmachinetemplates = merge $oldKubevirtmachinetemplates (dict $kmt.metadata.name $kmt) }}
-{{- end }}
-{{- end }}
-{{- end }}
-{{- end }}
-{{- end }}
-{{- end }}
-
-{{- range $oldKubevirtmachinetemplates }}
---
-apiVersion: infrastructure.cluster.x-k8s.io/v1alpha1
-kind: KubevirtMachineTemplate
-metadata:
-  name: {{ .metadata.name }}
-  namespace: {{ .metadata.Namespace }}
-spec:
-  {{- .spec | toYaml | nindent 2 }}
+      version: v1.29.0
 {{- end }}
--- a/packages/apps/kubernetes/templates/helmreleases/cert-manager.yaml
+++ b/packages/apps/kubernetes/templates/helmreleases/cert-manager.yaml
@@ -1,39 +0,0 @@
-{{- if .Values.addons.certManager.enabled }}
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: {{ .Release.Name }}-cert-manager
-  labels:
-    cozystack.io/repository: system
-    coztstack.io/target-cluster-name: {{ .Release.Name }}
-spec:
-  interval: 5m
-  releaseName: cert-manager
-  chart:
-    spec:
-      chart: cozy-cert-manager
-      reconcileStrategy: Revision
-      sourceRef:
-        kind: HelmRepository
-        name: cozystack-system
-        namespace: cozy-system
-  kubeConfig:
-    secretRef:
-      name: {{ .Release.Name }}-kubeconfig
-  targetNamespace: cozy-cert-manager
-  storageNamespace: cozy-cert-manager
-  install:
-    createNamespace: true
-    remediation:
-      retries: -1
-  upgrade:
-    remediation:
-      retries: -1
-  dependsOn:
-  {{- if lookup "helm.toolkit.fluxcd.io/v2" "HelmRelease" .Release.Namespace .Release.Name }}
-  - name: {{ .Release.Name }}
-    namespace: {{ .Release.Namespace }}
-  {{- end }}
-  - name: {{ .Release.Name }}-cilium
-    namespace: {{ .Release.Namespace }}
-{{- end }}
--- a/packages/apps/kubernetes/templates/helmreleases/cilium.yaml
+++ b/packages/apps/kubernetes/templates/helmreleases/cilium.yaml
@@ -1,4 +1,4 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
+apiVersion: helm.toolkit.fluxcd.io/v2beta1
 kind: HelmRelease
 metadata:
  name: {{ .Release.Name }}-cilium
@@ -6,7 +6,7 @@ metadata:
    cozystack.io/repository: system
    coztstack.io/target-cluster-name: {{ .Release.Name }}
 spec:
-  interval: 5m
+  interval: 1m
  releaseName: cilium
  chart:
    spec:
@@ -23,17 +23,10 @@ spec:
  storageNamespace: cozy-cilium
  install:
    createNamespace: true
-    remediation:
-      retries: -1
-  upgrade:
-    remediation:
-      retries: -1
  values:
    cilium:
      tunnel: disabled
-      autoDirectNodeRoutes: false
-      bpf:
-        masquerade: true
+      autoDirectNodeRoutes: true
      cgroup:
        autoMount:
          enabled: true
@@ -45,11 +38,9 @@ spec:
        chainingMode: ~
        customConf: false
        configMap: ""
-      routingMode: tunnel
+      routingMode: native
      enableIPv4Masquerade: true
-      ipv4NativeRoutingCIDR: ""
+      ipv4NativeRoutingCIDR: "10.244.0.0/16"
  dependsOn:
-  {{- if lookup "helm.toolkit.fluxcd.io/v2" "HelmRelease" .Release.Namespace .Release.Name }}
  - name: {{ .Release.Name }}
    namespace: {{ .Release.Namespace }}
-  {{- end }}
--- a/packages/apps/kubernetes/templates/helmreleases/csi.yaml
+++ b/packages/apps/kubernetes/templates/helmreleases/csi.yaml
@@ -1,4 +1,4 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
+apiVersion: helm.toolkit.fluxcd.io/v2beta1
 kind: HelmRelease
 metadata:
  name: {{ .Release.Name }}-csi
@@ -6,7 +6,7 @@ metadata:
    cozystack.io/repository: system
    coztstack.io/target-cluster-name: {{ .Release.Name }}
 spec:
-  interval: 5m
+  interval: 1m
  releaseName: csi
  chart:
    spec:
@@ -23,13 +23,6 @@ spec:
  storageNamespace: cozy-csi
  install:
    createNamespace: true
-    remediation:
-      retries: -1
-  upgrade:
-    remediation:
-      retries: -1
  dependsOn:
-  {{- if lookup "helm.toolkit.fluxcd.io/v2" "HelmRelease" .Release.Namespace .Release.Name }}
  - name: {{ .Release.Name }}
    namespace: {{ .Release.Namespace }}
-  {{- end }}
--- a/packages/apps/kubernetes/templates/helmreleases/delete.yaml
+++ b/packages/apps/kubernetes/templates/helmreleases/delete.yaml
@@ -20,23 +20,17 @@ spec:
          effect: "NoSchedule"
      containers:
        - name: kubectl
-          image: docker.io/clastix/kubectl:v1.30.1
+          image: docker.io/clastix/kubectl:v1.29.1
          command:
-            - /bin/sh
-            - -c
-            - |
-                kubectl
-                --namespace={{ .Release.Namespace }}
-                patch
-                helmrelease
-                {{ .Release.Name }}-cilium
-                {{ .Release.Name }}-csi
-                {{ .Release.Name }}-cert-manager
-                {{ .Release.Name }}-ingress-nginx
-                {{ .Release.Name }}-fluxcd-operator
-                {{ .Release.Name }}-fluxcd
-                -p '{"spec": {"suspend": true}}'
-                --type=merge --field-manager=flux-client-side-apply || true
+            - kubectl
+            - --namespace={{ .Release.Namespace }}
+            - patch
+            - helmrelease
+            - {{ .Release.Name }}-cilium
+            - {{ .Release.Name }}-csi
+            - -p
+            - '{"spec": {"suspend": true}}'
+            - --type=merge
 ---
 apiVersion: v1
 kind: ServiceAccount
@@ -66,10 +60,6 @@ rules:
    resourceNames:
      - {{ .Release.Name }}-cilium
      - {{ .Release.Name }}-csi
-      - {{ .Release.Name }}-cert-manager
-      - {{ .Release.Name }}-ingress-nginx
-      - {{ .Release.Name }}-fluxcd-operator
-      - {{ .Release.Name }}-fluxcd
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
--- a/packages/apps/kubernetes/templates/helmreleases/fluxcd.yaml
+++ b/packages/apps/kubernetes/templates/helmreleases/fluxcd.yaml
@@ -1,84 +0,0 @@
-{{- if .Values.addons.fluxcd.enabled }}
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: {{ .Release.Name }}-fluxcd-operator
-  labels:
-    cozystack.io/repository: system
-    coztstack.io/target-cluster-name: {{ .Release.Name }}
-spec:
-  interval: 5m
-  releaseName: fluxcd-operator
-  chart:
-    spec:
-      chart: cozy-fluxcd-operator
-      reconcileStrategy: Revision
-      sourceRef:
-        kind: HelmRepository
-        name: cozystack-system
-        namespace: cozy-system
-  kubeConfig:
-    secretRef:
-      name: {{ .Release.Name }}-kubeconfig
-  targetNamespace: cozy-fluxcd
-  storageNamespace: cozy-fluxcd
-  install:
-    createNamespace: true
-    remediation:
-      retries: -1
-  upgrade:
-    remediation:
-      retries: -1
-  values:
-    flux-operator:
-      fullnameOverride: flux-operator
-      tolerations: []
-      hostNetwork: false
-  dependsOn:
-  {{- if lookup "helm.toolkit.fluxcd.io/v2" "HelmRelease" .Release.Namespace .Release.Name }}
-  - name: {{ .Release.Name }}
-    namespace: {{ .Release.Namespace }}
-  {{- end }}
-  - name: {{ .Release.Name }}-cilium
-    namespace: {{ .Release.Namespace }}
---
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: {{ .Release.Name }}-fluxcd
-  labels:
-    cozystack.io/repository: system
-    coztstack.io/target-cluster-name: {{ .Release.Name }}
-spec:
-  interval: 5m
-  releaseName: fluxcd
-  chart:
-    spec:
-      chart: cozy-fluxcd
-      reconcileStrategy: Revision
-      sourceRef:
-        kind: HelmRepository
-        name: cozystack-system
-        namespace: cozy-system
-  kubeConfig:
-    secretRef:
-      name: {{ .Release.Name }}-kubeconfig
-  targetNamespace: cozy-fluxcd
-  storageNamespace: cozy-fluxcd
-  install:
-    createNamespace: true
-    remediation:
-      retries: -1
-  upgrade:
-    remediation:
-      retries: -1
-  dependsOn:
-  {{- if lookup "helm.toolkit.fluxcd.io/v2" "HelmRelease" .Release.Namespace .Release.Name }}
-  - name: {{ .Release.Name }}
-    namespace: {{ .Release.Namespace }}
-  {{- end }}
-  - name: {{ .Release.Name }}-cilium
-    namespace: {{ .Release.Namespace }}
-  - name: {{ .Release.Name }}-fluxcd-operator
-    namespace: {{ .Release.Namespace }}
-{{- end }}
--- a/packages/apps/kubernetes/templates/helmreleases/ingress-nginx.yaml
+++ b/packages/apps/kubernetes/templates/helmreleases/ingress-nginx.yaml
@@ -1,49 +0,0 @@
-{{- if .Values.addons.ingressNginx.enabled }}
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: {{ .Release.Name }}-ingress-nginx
-  labels:
-    cozystack.io/repository: system
-    coztstack.io/target-cluster-name: {{ .Release.Name }}
-spec:
-  interval: 5m
-  releaseName: ingress-nginx
-  chart:
-    spec:
-      chart: cozy-ingress-nginx
-      reconcileStrategy: Revision
-      sourceRef:
-        kind: HelmRepository
-        name: cozystack-system
-        namespace: cozy-system
-  kubeConfig:
-    secretRef:
-      name: {{ .Release.Name }}-kubeconfig
-  targetNamespace: cozy-ingress-nginx
-  storageNamespace: cozy-ingress-nginx
-  install:
-    createNamespace: true
-    remediation:
-      retries: -1
-  upgrade:
-    remediation:
-      retries: -1
-  values:
-    ingress-nginx:
-      fullnameOverride: ingress-nginx
-      controller:
-        kind: DaemonSet
-        hostNetwork: true
-        service:
-          enabled: false
-      nodeSelector:
-        node-role.kubernetes.io/ingress-nginx: ""
-  dependsOn:
-  {{- if lookup "helm.toolkit.fluxcd.io/v2" "HelmRelease" .Release.Namespace .Release.Name }}
-  - name: {{ .Release.Name }}
-    namespace: {{ .Release.Namespace }}
-  {{- end }}
-  - name: {{ .Release.Name }}-cilium
-    namespace: {{ .Release.Namespace }}
-{{- end }}
--- a/packages/apps/kubernetes/templates/ingress.yaml
+++ b/packages/apps/kubernetes/templates/ingress.yaml
@@ -1,45 +0,0 @@
-{{- $myNS := lookup "v1" "Namespace" "" .Release.Namespace }}
-{{- $ingress := index $myNS.metadata.annotations "namespace.cozystack.io/ingress" }}
-{{- if .Values.addons.ingressNginx.hosts }}
---
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: {{ .Release.Name }}-ingress-nginx
-  annotations:
-    nginx.ingress.kubernetes.io/ssl-redirect: "false"
-    nginx.ingress.kubernetes.io/ssl-passthrough: "true"
-spec:
-  ingressClassName: "{{ $ingress }}"
-  rules:
-  {{- range .Values.addons.ingressNginx.hosts }}
-  - host: {{ . | quote }}
-    http:
-      paths:
-      - path: /
-        pathType: ImplementationSpecific
-        backend:
-          service:
-            name: {{ $.Release.Name }}-ingress-nginx
-            port:
-              number: 443
-  {{- end }}
---
-apiVersion: v1
-kind: Service
-metadata:
-  name: {{ .Release.Name }}-ingress-nginx
-spec:
-  ports:
-  - appProtocol: http
-    name: http
-    port: 80
-    targetPort: 80
-  - appProtocol: https
-    name: https
-    port: 443
-    targetPort: 443
-  selector:
-    cluster.x-k8s.io/cluster-name: {{ .Release.Name }}
-    node-role.kubernetes.io/ingress-nginx: ""
-{{- end }}
--- a/packages/apps/kubernetes/values.schema.json
+++ b/packages/apps/kubernetes/values.schema.json
@@ -1,62 +0,0 @@
-{
-    "title": "Chart Values",
-    "type": "object",
-    "properties": {
-        "host": {
-            "type": "string",
-            "description": "The hostname used to access the Kubernetes cluster externally (defaults to using the cluster name as a subdomain for the tenant host).",
-            "default": ""
-        },
-        "controlPlane": {
-            "type": "object",
-            "properties": {
-                "replicas": {
-                    "type": "number",
-                    "description": "Number of replicas for Kubernetes contorl-plane components",
-                    "default": 2
-                }
-            }
-        },
-        "addons": {
-            "type": "object",
-            "properties": {
-                "certManager": {
-                    "type": "object",
-                    "properties": {
-                        "enabled": {
-                            "type": "boolean",
-                            "description": "Enables the cert-manager",
-                            "default": false
-                        }
-                    }
-                },
-                "ingressNginx": {
-                    "type": "object",
-                    "properties": {
-                        "enabled": {
-                            "type": "boolean",
-                            "description": "Enable Ingress-NGINX controller (expect nodes with 'ingress-nginx' role)",
-                            "default": false
-                        },
-                        "hosts": {
-                            "type": "array",
-                            "description": "List of domain names that should be passed through to the cluster by upper cluster",
-                            "default": [],
-                            "items": {}
-                        }
-                    }
-                },
-                "fluxcd": {
-                    "type": "object",
-                    "properties": {
-                        "enabled": {
-                            "type": "boolean",
-                            "description": "Enables Flux CD",
-                            "default": false
-                        }
-                    }
-                }
-            }
-        }
-    }
-}
--- a/packages/apps/kubernetes/values.yaml
+++ b/packages/apps/kubernetes/values.yaml
@@ -1,14 +1,6 @@
-## @section Common parameters
-
-## @param host The hostname used to access the Kubernetes cluster externally (defaults to using the cluster name as a subdomain for the tenant host).
-## @param controlPlane.replicas Number of replicas for Kubernetes contorl-plane components
-##
 host: ""
 controlPlane:
  replicas: 2
-
-## @param nodeGroups [object] nodeGroups configuration
-##
 nodeGroups:
  md0:
    minReplicas: 0
@@ -16,36 +8,3 @@ nodeGroups:
    resources:
      cpu: 2
      memory: 1024Mi
-    roles:
-    - ingress-nginx
-
-## @section Cluster Addons
-##
-addons:
-
-  ## Cert-manager: automatically creates and manages SSL/TLS certificate
-  ##
-  certManager:
-    ## @param addons.certManager.enabled Enables the cert-manager
-    enabled: false
-
-  ## Ingress-NGINX Controller
-  ##
-  ingressNginx:
-    ## @param addons.ingressNginx.enabled Enable Ingress-NGINX controller (expect nodes with 'ingress-nginx' role)
-    ##
-    enabled: false
-    ## @param addons.ingressNginx.hosts List of domain names that should be passed through to the cluster by upper cluster
-    ## e.g:
-    ## hosts:
-    ## - example.org
-    ## - foo.example.net
-    ##
-    hosts: []
-
-  ## Flux CD
-  ##
-  fluxcd:
-    ## @param addons.fluxcd.enabled Enables Flux CD
-    ##
-    enabled: false
--- a/packages/apps/mysql/Makefile
+++ b/packages/apps/mysql/Makefile
@@ -1,2 +0,0 @@
-generate:
-	readme-generator -v values.yaml -s values.schema.json -r README.md
--- a/packages/apps/mysql/README.md
+++ b/packages/apps/mysql/README.md
@@ -62,34 +62,3 @@ more details:
  mysqldump -h <slave> -P 3306 -u<user> -p<password> --column-statistics=0 <database> <table> ~/tmp/fix-table.sql
  mysql -h <master> -P 3306 -u<user> -p<password> <database> < ~/tmp/fix-table.sql
  ```
-
-## Parameters
-
-### Common parameters
-
-| Name       | Description                                     | Value   |
-| ---------- | ----------------------------------------------- | ------- |
-| `external` | Enable external access from outside the cluster | `false` |
-| `size`     | Persistent Volume size                          | `10Gi`  |
-| `replicas` | Number of MariaDB replicas                      | `2`     |
-
-### Configuration parameters
-
-| Name        | Description             | Value |
-| ----------- | ----------------------- | ----- |
-| `users`     | Users configuration     | `{}`  |
-| `databases` | Databases configuration | `[]`  |
-
-### Backup parameters
-
-| Name                     | Description                                    | Value                                                  |
-| ------------------------ | ---------------------------------------------- | ------------------------------------------------------ |
-| `backup.enabled`         | Enable pereiodic backups                       | `false`                                                |
-| `backup.s3Region`        | The AWS S3 region where backups are stored     | `us-east-1`                                            |
-| `backup.s3Bucket`        | The S3 bucket used for storing backups         | `s3.example.org/postgres-backups`                      |
-| `backup.schedule`        | Cron schedule for automated backups            | `0 2 * * *`                                            |
-| `backup.cleanupStrategy` | The strategy for cleaning up old backups       | `--keep-last=3 --keep-daily=3 --keep-within-weekly=1m` |
-| `backup.s3AccessKey`     | The access key for S3, used for authentication | `oobaiRus9pah8PhohL1ThaeTa4UVa7gu`                     |
-| `backup.s3SecretKey`     | The secret key for S3, used for authentication | `ju3eum4dekeich9ahM1te8waeGai0oog`                     |
-| `backup.resticPassword`  | The password for Restic backup encryption      | `ChaXoveekoh6eigh4siesheeda2quai0`                     |
-
--- a/packages/apps/mysql/templates/mariadb.yaml
+++ b/packages/apps/mysql/templates/mariadb.yaml
@@ -4,11 +4,9 @@ kind: MariaDB
 metadata:
  name: {{ .Release.Name }}
 spec:
-  {{- if (and .Values.users.root .Values.users.root.password) }}
  rootPasswordSecretKeyRef:
    name: {{ .Release.Name }}
    key: root-password
-  {{- end }}

  image: "mariadb:11.0.2"

--- a/packages/apps/mysql/values.schema.json
+++ b/packages/apps/mysql/values.schema.json
@@ -1,72 +0,0 @@
-{
-    "title": "Chart Values",
-    "type": "object",
-    "properties": {
-        "external": {
-            "type": "boolean",
-            "description": "Enable external access from outside the cluster",
-            "default": false
-        },
-        "size": {
-            "type": "string",
-            "description": "Persistent Volume size",
-            "default": "10Gi"
-        },
-        "replicas": {
-            "type": "number",
-            "description": "Number of MariaDB replicas",
-            "default": 2
-        },
-        "databases": {
-            "type": "array",
-            "description": "Databases configuration",
-            "default": [],
-            "items": {}
-        },
-        "backup": {
-            "type": "object",
-            "properties": {
-                "enabled": {
-                    "type": "boolean",
-                    "description": "Enable pereiodic backups",
-                    "default": false
-                },
-                "s3Region": {
-                    "type": "string",
-                    "description": "The AWS S3 region where backups are stored",
-                    "default": "us-east-1"
-                },
-                "s3Bucket": {
-                    "type": "string",
-                    "description": "The S3 bucket used for storing backups",
-                    "default": "s3.example.org/postgres-backups"
-                },
-                "schedule": {
-                    "type": "string",
-                    "description": "Cron schedule for automated backups",
-                    "default": "0 2 * * *"
-                },
-                "cleanupStrategy": {
-                    "type": "string",
-                    "description": "The strategy for cleaning up old backups",
-                    "default": "--keep-last=3 --keep-daily=3 --keep-within-weekly=1m"
-                },
-                "s3AccessKey": {
-                    "type": "string",
-                    "description": "The access key for S3, used for authentication",
-                    "default": "oobaiRus9pah8PhohL1ThaeTa4UVa7gu"
-                },
-                "s3SecretKey": {
-                    "type": "string",
-                    "description": "The secret key for S3, used for authentication",
-                    "default": "ju3eum4dekeich9ahM1te8waeGai0oog"
-                },
-                "resticPassword": {
-                    "type": "string",
-                    "description": "The password for Restic backup encryption",
-                    "default": "ChaXoveekoh6eigh4siesheeda2quai0"
-                }
-            }
-        }
-    }
-}
--- a/packages/apps/mysql/values.yaml
+++ b/packages/apps/mysql/values.yaml
@@ -1,50 +1,26 @@
-## @section Common parameters
-
-## @param external Enable external access from outside the cluster
-## @param size Persistent Volume size
-## @param replicas Number of MariaDB replicas
-##
 external: false
 size: 10Gi
+
 replicas: 2

-## @section Configuration parameters
+users:
+  root:
+    password: strongpassword
+  user1:
+    privileges: ['ALL']
+    maxUserConnections: 1000
+    password: hackme
+  user2:
+    privileges: ['SELECT']
+    maxUserConnections: 1000
+    password: hackme

-## @param users [object] Users configuration
-## Example:
-## users:
-##   root:
-##     password: strongpassword
-##   user1:
-##     privileges: ['ALL']
-##     maxUserConnections: 1000
-##     password: hackme
-##   user2:
-##     privileges: ['SELECT']
-##     maxUserConnections: 1000
-##     password: hackme
-##
-users: {}
+databases:
+- wordpress1
+- wordpress2
+- wordpress3
+- wordpress4

-## @param databases Databases configuration
-## Example:
-## databases:
-## - wordpress1
-## - wordpress2
-## - wordpress3
-## - wordpress4
-databases: []
-
-## @section Backup parameters
-
-## @param backup.enabled Enable pereiodic backups
-## @param backup.s3Region The AWS S3 region where backups are stored
-## @param backup.s3Bucket The S3 bucket used for storing backups
-## @param backup.schedule Cron schedule for automated backups
-## @param backup.cleanupStrategy The strategy for cleaning up old backups
-## @param backup.s3AccessKey The access key for S3, used for authentication
-## @param backup.s3SecretKey The secret key for S3, used for authentication
-## @param backup.resticPassword The password for Restic backup encryption
 backup:
  enabled: false
  s3Region: us-east-1
--- a/packages/apps/postgres/Chart.yaml
+++ b/packages/apps/postgres/Chart.yaml
@@ -16,7 +16,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.3.0
+version: 0.2.0

 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
--- a/packages/apps/postgres/Makefile
+++ b/packages/apps/postgres/Makefile
@@ -1,2 +0,0 @@
-generate:
-	readme-generator -v values.yaml -s values.schema.json -r README.md
--- a/packages/apps/postgres/README.md
+++ b/packages/apps/postgres/README.md
@@ -30,37 +30,3 @@ restic -r s3:s3.example.org/postgres-backups/database_name restore latest --targ

 more details:
 - https://itnext.io/restic-effective-backup-from-stdin-4bc1e8f083c1
-
-## Parameters
-
-### Common parameters
-
-| Name                     | Description                                                                                                             | Value   |
-| ------------------------ | ----------------------------------------------------------------------------------------------------------------------- | ------- |
-| `external`               | Enable external access from outside the cluster                                                                         | `false` |
-| `size`                   | Persistent Volume size                                                                                                  | `10Gi`  |
-| `replicas`               | Number of Postgres replicas                                                                                             | `2`     |
-| `quorum.minSyncReplicas` | Minimum number of synchronous replicas that must acknowledge a transaction before it is considered committed.           | `0`     |
-| `quorum.maxSyncReplicas` | Maximum number of synchronous replicas that can acknowledge a transaction (must be lower than the number of instances). | `0`     |
-
-### Configuration parameters
-
-| Name        | Description             | Value |
-| ----------- | ----------------------- | ----- |
-| `users`     | Users configuration     | `{}`  |
-| `databases` | Databases configuration | `{}`  |
-
-### Backup parameters
-
-| Name                     | Description                                    | Value                                                  |
-| ------------------------ | ---------------------------------------------- | ------------------------------------------------------ |
-| `backup.enabled`         | Enable pereiodic backups                       | `false`                                                |
-| `backup.s3Region`        | The AWS S3 region where backups are stored     | `us-east-1`                                            |
-| `backup.s3Bucket`        | The S3 bucket used for storing backups         | `s3.example.org/postgres-backups`                      |
-| `backup.schedule`        | Cron schedule for automated backups            | `0 2 * * *`                                            |
-| `backup.cleanupStrategy` | The strategy for cleaning up old backups       | `--keep-last=3 --keep-daily=3 --keep-within-weekly=1m` |
-| `backup.s3AccessKey`     | The access key for S3, used for authentication | `oobaiRus9pah8PhohL1ThaeTa4UVa7gu`                     |
-| `backup.s3SecretKey`     | The secret key for S3, used for authentication | `ju3eum4dekeich9ahM1te8waeGai0oog`                     |
-| `backup.resticPassword`  | The password for Restic backup encryption      | `ChaXoveekoh6eigh4siesheeda2quai0`                     |
-
-
--- a/packages/apps/postgres/templates/db.yaml
+++ b/packages/apps/postgres/templates/db.yaml
@@ -11,9 +11,6 @@ spec:
    parameters:
      max_wal_senders: "30"

-  minSyncReplicas: {{ .Values.quorum.minSyncReplicas }}
-  maxSyncReplicas: {{ .Values.quorum.maxSyncReplicas }}
-
  monitoring:
    enablePodMonitor: true

--- a/packages/apps/postgres/templates/init-script.yaml
+++ b/packages/apps/postgres/templates/init-script.yaml
@@ -100,13 +100,13 @@ stringData:
    echo "== assign roles to users"
    psql -v ON_ERROR_STOP=1 --echo-all <<\EOT
    {{- range $database, $d := .Values.databases }}
-    {{- range $user, $u := $.Values.users }}
-    {{- if has $user $d.roles.admin }}
+    {{- range $user, $u := $.Values.roles }}
+    {{- if has $user $d.users.admin }}
    GRANT {{ $database }}_admin TO {{ $user }};
    {{- else }}
    REVOKE {{ $database }}_admin FROM {{ $user }};
    {{- end }}
-    {{- if has $user $d.roles.readonly }}
+    {{- if has $user $d.users.readonly }}
    GRANT {{ $database }}_readonly TO {{ $user }};
    {{- else }}
    REVOKE {{ $database }}_readonly FROM {{ $user }};
--- a/packages/apps/postgres/values.schema.json
+++ b/packages/apps/postgres/values.schema.json
@@ -1,86 +0,0 @@
-{
-    "title": "Chart Values",
-    "type": "object",
-    "properties": {
-        "external": {
-            "type": "boolean",
-            "description": "Enable external access from outside the cluster",
-            "default": false
-        },
-        "size": {
-            "type": "string",
-            "description": "Persistent Volume size",
-            "default": "10Gi"
-        },
-        "replicas": {
-            "type": "number",
-            "description": "Number of Postgres replicas",
-            "default": 2
-        },
-        "quorum": {
-            "type": "object",
-            "properties": {
-                "minSyncReplicas": {
-                    "type": "number",
-                    "description": "Minimum number of synchronous replicas that must acknowledge a transaction before it is considered committed.",
-                    "default": 0
-                },
-                "maxSyncReplicas": {
-                    "type": "number",
-                    "description": "Maximum number of synchronous replicas that can acknowledge a transaction (must be lower than the number of instances).",
-                    "default": 0
-                }
-            }
-        },
-        "databases": {
-            "type": "object",
-            "description": "Databases configuration",
-            "default": {}
-        },
-        "backup": {
-            "type": "object",
-            "properties": {
-                "enabled": {
-                    "type": "boolean",
-                    "description": "Enable pereiodic backups",
-                    "default": false
-                },
-                "s3Region": {
-                    "type": "string",
-                    "description": "The AWS S3 region where backups are stored",
-                    "default": "us-east-1"
-                },
-                "s3Bucket": {
-                    "type": "string",
-                    "description": "The S3 bucket used for storing backups",
-                    "default": "s3.example.org/postgres-backups"
-                },
-                "schedule": {
-                    "type": "string",
-                    "description": "Cron schedule for automated backups",
-                    "default": "0 2 * * *"
-                },
-                "cleanupStrategy": {
-                    "type": "string",
-                    "description": "The strategy for cleaning up old backups",
-                    "default": "--keep-last=3 --keep-daily=3 --keep-within-weekly=1m"
-                },
-                "s3AccessKey": {
-                    "type": "string",
-                    "description": "The access key for S3, used for authentication",
-                    "default": "oobaiRus9pah8PhohL1ThaeTa4UVa7gu"
-                },
-                "s3SecretKey": {
-                    "type": "string",
-                    "description": "The secret key for S3, used for authentication",
-                    "default": "ju3eum4dekeich9ahM1te8waeGai0oog"
-                },
-                "resticPassword": {
-                    "type": "string",
-                    "description": "The password for Restic backup encryption",
-                    "default": "ChaXoveekoh6eigh4siesheeda2quai0"
-                }
-            }
-        }
-    }
-}
--- a/packages/apps/postgres/values.yaml
+++ b/packages/apps/postgres/values.yaml
@@ -1,64 +1,34 @@
-## @section Common parameters
-
-## @param external Enable external access from outside the cluster
-## @param size Persistent Volume size
-## @param replicas Number of Postgres replicas
-##
 external: false
 size: 10Gi
 replicas: 2

-## Configuration for the quorum-based synchronous replication
-## @param quorum.minSyncReplicas Minimum number of synchronous replicas that must acknowledge a transaction before it is considered committed.
-## @param quorum.maxSyncReplicas Maximum number of synchronous replicas that can acknowledge a transaction (must be lower than the number of instances).
-quorum:
-  minSyncReplicas: 0
-  maxSyncReplicas: 0
+users:
+  user1:
+    password: strongpassword
+  user2:
+    password: hackme
+  airflow:
+    password: qwerty123
+  debezium:
+    replication: true

-## @section Configuration parameters
+databases:

-## @param users [object] Users configuration
-## Example:
-## users:
-##   user1:
-##     password: strongpassword
-##   user2:
-##     password: hackme
-##   airflow:
-##     password: qwerty123
-##   debezium:
-##     replication: true
-##
-users: {}
+  myapp:
+    roles:
+      admin:
+      - user1
+      - debezium
+      readonly:
+      - user2

-## @param databases Databases configuration
-## Example:
-## databases:
-##   myapp:
-##     roles:
-##       admin:
-##       - user1
-##       - debezium
-##       readonly:
-##       - user2
-##   airflow:
-##     roles:
-##       admin:
-##       - airflow
-##     extensions:
-##     - hstore
-databases: {}
+  airflow:
+    roles:
+      admin:
+      - airflow
+    extensions:
+    - hstore

-## @section Backup parameters
-
-## @param backup.enabled Enable pereiodic backups
-## @param backup.s3Region The AWS S3 region where backups are stored
-## @param backup.s3Bucket The S3 bucket used for storing backups
-## @param backup.schedule Cron schedule for automated backups
-## @param backup.cleanupStrategy The strategy for cleaning up old backups
-## @param backup.s3AccessKey The access key for S3, used for authentication
-## @param backup.s3SecretKey The secret key for S3, used for authentication
-## @param backup.resticPassword The password for Restic backup encryption
 backup:
  enabled: false
  s3Region: us-east-1
--- a/packages/apps/rabbitmq/Makefile
+++ b/packages/apps/rabbitmq/Makefile
@@ -1,2 +0,0 @@
-generate:
-	readme-generator -v values.yaml -s values.schema.json -r README.md
--- a/packages/apps/rabbitmq/README.md
+++ b/packages/apps/rabbitmq/README.md
@@ -8,12 +8,3 @@ The service utilizes official RabbitMQ operator. This ensures the reliability an

 - Github: https://github.com/rabbitmq/cluster-operator/
 - Docs: https://www.rabbitmq.com/kubernetes/operator/operator-overview.html
-
-## Parameters
-
-### Common parameters
-
-| Name       | Description                                     | Value   |
-| ---------- | ----------------------------------------------- | ------- |
-| `external` | Enable external access from outside the cluster | `false` |
-| `replicas` | Number of RabbitMQ replicas                     | `3`     |
--- a/packages/apps/rabbitmq/values.schema.json
+++ b/packages/apps/rabbitmq/values.schema.json
@@ -1,16 +1,14 @@
 {
-    "title": "Chart Values",
-    "type": "object",
-    "properties": {
-        "external": {
-            "type": "boolean",
-            "description": "Enable external access from outside the cluster",
-            "default": false
-        },
-        "replicas": {
-            "type": "number",
-            "description": "Number of RabbitMQ replicas",
-            "default": 3
-        }
+  "$schema": "http://json-schema.org/schema#",
+  "type": "object",
+  "properties": {
+    "external": {
+      "type": "boolean",
+      "title": "Enable external Access"
+    },
+    "replicas": {
+      "type": "integer",
+      "title": "Replicas"
    }
-}
+  }
+}
--- a/packages/apps/rabbitmq/values.yaml
+++ b/packages/apps/rabbitmq/values.yaml
@@ -1,7 +1,2 @@
-## @section Common parameters
-
-## @param external Enable external access from outside the cluster
-## @param replicas Number of RabbitMQ replicas
-##
-external: false
 replicas: 3
+external: false
--- a/packages/apps/redis/Makefile
+++ b/packages/apps/redis/Makefile
@@ -1,2 +0,0 @@
-generate:
-	readme-generator -v values.yaml -s values.schema.json -r README.md
--- a/packages/apps/redis/README.md
+++ b/packages/apps/redis/README.md
@@ -8,15 +8,3 @@ Service utilizes the Spotahome Redis Operator for efficient management and orche

 - Docs: https://redis.io/docs/
 - GitHub: https://github.com/spotahome/redis-operator
-
-## Parameters
-
-### Common parameters
-
-| Name       | Description                                     | Value   |
-| ---------- | ----------------------------------------------- | ------- |
-| `external` | Enable external access from outside the cluster | `false` |
-| `size`     | Persistent Volume size                          | `1Gi`   |
-| `replicas` | Number of Redis replicas                        | `2`     |
-
-
--- a/packages/apps/redis/values.schema.json
+++ b/packages/apps/redis/values.schema.json
@@ -1,21 +1,18 @@
 {
-    "title": "Chart Values",
-    "type": "object",
-    "properties": {
-        "external": {
-            "type": "boolean",
-            "description": "Enable external access from outside the cluster",
-            "default": false
-        },
-        "size": {
-            "type": "string",
-            "description": "Persistent Volume size",
-            "default": "1Gi"
-        },
-        "replicas": {
-            "type": "number",
-            "description": "Number of Redis replicas",
-            "default": 2
-        }
+  "$schema": "http://json-schema.org/schema#",
+  "type": "object",
+  "properties": {
+    "external": {
+      "type": "boolean",
+      "title": "Enable external Access"
+    },
+    "size": {
+      "type": "string",
+      "title": "Disk Size"
+    },
+    "replicas": {
+      "type": "integer",
+      "title": "Replicas"
    }
-}
+  }
+}
--- a/packages/apps/redis/values.yaml
+++ b/packages/apps/redis/values.yaml
@@ -1,9 +1,3 @@
-## @section Common parameters
-
-## @param external Enable external access from outside the cluster
-## @param size Persistent Volume size
-## @param replicas Number of Redis replicas
-##
-external: false
-size: 1Gi
 replicas: 2
+external: false
+size: 5Gi
--- a/packages/apps/tcp-balancer/Makefile
+++ b/packages/apps/tcp-balancer/Makefile
@@ -1,4 +0,0 @@
-generate:
-	readme-generator -v values.yaml -s values.schema.json.tmp -r README.md
-	cat values.schema.json.tmp | jq '.properties.httpAndHttps.properties.mode.enum = ["tcp","tcp-with-proxy"]' > values.schema.json
-	rm -f values.schema.json.tmp
--- a/packages/apps/tcp-balancer/README.md
+++ b/packages/apps/tcp-balancer/README.md
@@ -7,23 +7,3 @@ The Managed TCP Load Balancer Service simplifies the deployment and management o
 Managed TCP Load Balancer Service efficiently utilizes HAProxy for load balancing purposes. HAProxy is a well-established and reliable solution for distributing incoming TCP traffic across multiple backend servers, ensuring high availability and efficient resource utilization. This deployment choice guarantees the seamless and dependable operation of your load balancing infrastructure.

 - Docs: https://www.haproxy.com/documentation/
-
-## Parameters
-
-### Common parameters
-
-| Name       | Description                                     | Value   |
-| ---------- | ----------------------------------------------- | ------- |
-| `external` | Enable external access from outside the cluster | `false` |
-| `replicas` | Number of HAProxy replicas                      | `2`     |
-
-### Configuration parameters
-
-| Name                             | Description                                                   | Value   |
-| -------------------------------- | ------------------------------------------------------------- | ------- |
-| `httpAndHttps.mode`              | Mode for balancer. Allowed values: `tcp` and `tcp-with-proxy` | `tcp`   |
-| `httpAndHttps.targetPorts.http`  | HTTP port number.                                             | `80`    |
-| `httpAndHttps.targetPorts.https` | HTTPS port number.                                            | `443`   |
-| `httpAndHttps.endpoints`         | Endpoint addresses list                                       | `[]`    |
-| `whitelistHTTP`                  | Secure HTTP by enabling  client networks whitelisting         | `false` |
-| `whitelist`                      | List of client networks                                       | `[]`    |
--- a/packages/apps/tcp-balancer/values.schema.json
+++ b/packages/apps/tcp-balancer/values.schema.json
@@ -1,62 +0,0 @@
-{
-  "title": "Chart Values",
-  "type": "object",
-  "properties": {
-    "external": {
-      "type": "boolean",
-      "description": "Enable external access from outside the cluster",
-      "default": false
-    },
-    "replicas": {
-      "type": "number",
-      "description": "Number of HAProxy replicas",
-      "default": 2
-    },
-    "httpAndHttps": {
-      "type": "object",
-      "properties": {
-        "mode": {
-          "type": "string",
-          "description": "Mode for balancer. Allowed values: `tcp` and `tcp-with-proxy`",
-          "default": "tcp",
-          "enum": [
-            "tcp",
-            "tcp-with-proxy"
-          ]
-        },
-        "targetPorts": {
-          "type": "object",
-          "properties": {
-            "http": {
-              "type": "number",
-              "description": "HTTP port number.",
-              "default": 80
-            },
-            "https": {
-              "type": "number",
-              "description": "HTTPS port number.",
-              "default": 443
-            }
-          }
-        },
-        "endpoints": {
-          "type": "array",
-          "description": "Endpoint addresses list",
-          "default": [],
-          "items": {}
-        }
-      }
-    },
-    "whitelistHTTP": {
-      "type": "boolean",
-      "description": "Secure HTTP by enabling  client networks whitelisting",
-      "default": false
-    },
-    "whitelist": {
-      "type": "array",
-      "description": "List of client networks",
-      "default": [],
-      "items": {}
-    }
-  }
-}
--- a/packages/apps/tcp-balancer/values.yaml
+++ b/packages/apps/tcp-balancer/values.yaml
@@ -1,45 +1,19 @@
-## @section Common parameters
-
-## @param external Enable external access from outside the cluster
-## @param replicas Number of HAProxy replicas
-##
 external: false
 replicas: 2
-
-## @section Configuration parameters
-
-## @param httpAndHttps.mode Mode for balancer. Allowed values: `tcp` and `tcp-with-proxy`
-## @param httpAndHttps.targetPorts.http HTTP port number.
-## @param httpAndHttps.targetPorts.https HTTPS port number.
-## @param httpAndHttps.endpoints Endpoint addresses list
-## Example:
-## httpAndHttps:
-##   mode: tcp
-##   targetPorts:
-##     http: 80
-##     https: 443
-##   endpoints:
-##    - 10.100.3.1
-##    - 10.100.3.11
-##    - 10.100.3.2
-##    - 10.100.3.12
-##    - 10.100.3.3
-##    - 10.100.3.13
-
 httpAndHttps:
  mode: tcp
  targetPorts:
    http: 80
    https: 443
-  endpoints: []
+  endpoints:
+   - 10.100.3.1
+   - 10.100.3.11
+   - 10.100.3.2
+   - 10.100.3.12
+   - 10.100.3.3
+   - 10.100.3.13

-## @param whitelistHTTP Secure HTTP by enabling  client networks whitelisting
-## @param whitelist List of client networks
-## Example:
-## whitelistHTTP: true
-## whitelist:
-## - "1.2.3.4"
-## - "10.100.0.0/16"
-##
 whitelistHTTP: false
-whitelist: []
+whitelist:
+- "1.2.3.4"
+- "10.100.0.0/16"
--- a/packages/apps/tenant/Chart.yaml
+++ b/packages/apps/tenant/Chart.yaml
@@ -1,7 +1,7 @@
 apiVersion: v2
 name: tenant
-description: Separated tenant namespace
+description: Additional tenant namespace
 icon: https://upload.wikimedia.org/wikipedia/commons/0/04/User_icon_1.svg

 type: application
-version: 1.2.0
+version: 1.0.0
--- a/packages/apps/tenant/Makefile
+++ b/packages/apps/tenant/Makefile
@@ -1,2 +0,0 @@
-generate:
-	readme-generator -v values.yaml -s values.schema.json -r README.md
--- a/packages/apps/tenant/README.md
+++ b/packages/apps/tenant/README.md
@@ -25,7 +25,7 @@ tenant-root (example.org)

 Thus, you can create `tenant-u1` with a set of services like `etcd`, `ingress`, `monitoring`. And create another tenant namespace `tenant-u2` inside of `tenant-u1`.

-Let's see what will happen when you run Kubernetes and Postgres under `tenant-u2` namespace.
+Let's see what will happen when you run Kubernetes and Postgres under `tenant-u2` namesapce.

 Since `tenant-u2` does not have its own cluster services like `etcd`, `ingress`, and `monitoring`, the applications will use the cluster services of the parent tenant.  
 This in turn means:
@@ -45,14 +45,3 @@ tenant-u1
    ├── kubernetes-cluster1
    └── postgres-db1
 ```
-
-## Parameters
-
-### Common parameters
-
-| Name         | Description                                                                                                                 | Value   |
-| ------------ | --------------------------------------------------------------------------------------------------------------------------- | ------- |
-| `host`       | The hostname used to access tenant services (defaults to using the tenant name as a subdomain for it's parent tenant host). | `""`    |
-| `etcd`       | Deploy own Etcd cluster                                                                                                     | `false` |
-| `monitoring` | Deploy own Monitoring Stack                                                                                                 | `false` |
-| `ingress`    | Deploy own Ingress Controller                                                                                               | `false` |
--- a/packages/apps/tenant/templates/etcd.yaml
+++ b/packages/apps/tenant/templates/etcd.yaml
@@ -1,5 +1,5 @@
 {{- if .Values.etcd }}
-apiVersion: helm.toolkit.fluxcd.io/v2
+apiVersion: helm.toolkit.fluxcd.io/v2beta1
 kind: HelmRelease
 metadata:
  name: etcd
--- a/packages/apps/tenant/templates/ingress.yaml
+++ b/packages/apps/tenant/templates/ingress.yaml
@@ -1,5 +1,5 @@
 {{- if .Values.ingress }}
-apiVersion: helm.toolkit.fluxcd.io/v2
+apiVersion: helm.toolkit.fluxcd.io/v2beta1
 kind: HelmRelease
 metadata:
  name: ingress
--- a/packages/apps/tenant/templates/monitoring.yaml
+++ b/packages/apps/tenant/templates/monitoring.yaml
@@ -1,5 +1,5 @@
 {{- if .Values.monitoring }}
-apiVersion: helm.toolkit.fluxcd.io/v2
+apiVersion: helm.toolkit.fluxcd.io/v2beta1
 kind: HelmRelease
 metadata:
  name: monitoring
--- a/packages/apps/tenant/values.schema.json
+++ b/packages/apps/tenant/values.schema.json
@@ -1,26 +1,27 @@
 {
-    "title": "Chart Values",
-    "type": "object",
-    "properties": {
-        "host": {
-            "type": "string",
-            "description": "The hostname used to access tenant services (defaults to using the tenant name as a subdomain for it's parent tenant host).",
-            "default": ""
-        },
-        "etcd": {
-            "type": "boolean",
-            "description": "Deploy own Etcd cluster",
-            "default": false
-        },
-        "monitoring": {
-            "type": "boolean",
-            "description": "Deploy own Monitoring Stack",
-            "default": false
-        },
-        "ingress": {
-            "type": "boolean",
-            "description": "Deploy own Ingress Controller",
-            "default": false
-        }
+  "$schema": "http://json-schema.org/schema#",
+  "type": "object",
+  "properties": {
+    "host": {
+      "type": "string",
+      "form": true,
+      "title": "Domain name for this tenant",
+      "description": "This host will be used for all apps deployed in this tenant"
+    },
+    "etcd": {
+      "type": "boolean",
+      "title": "Deploy own Etcd cluster",
+      "form": true
+    },
+    "monitoring": {
+      "type": "boolean",
+      "title": "Deploy own Monitoring Stack",
+      "form": true
+    },
+    "ingress": {
+      "type": "boolean",
+      "title": "Deploy own Ingress Controller",
+      "form": true
    }
-}
+  }
+}
--- a/packages/apps/tenant/values.yaml
+++ b/packages/apps/tenant/values.yaml
@@ -1,9 +1,3 @@
-## @section Common parameters
-
-## @param host The hostname used to access tenant services (defaults to using the tenant name as a subdomain for it's parent tenant host).
-## @param etcd Deploy own Etcd cluster
-## @param monitoring Deploy own Monitoring Stack
-## @param ingress Deploy own Ingress Controller
 host: ""
 etcd: false
 monitoring: false
--- a/packages/apps/versions_map
+++ b/packages/apps/versions_map
@@ -1,24 +1,15 @@
 clickhouse 0.1.0 ca79f72
-clickhouse 0.2.0 7cd7de73
-clickhouse 0.2.1 HEAD
+clickhouse 0.2.0 HEAD
 http-cache 0.1.0 a956713
 http-cache 0.2.0 HEAD
-kafka 0.1.0 760f86d2
-kafka 0.2.0 a2cc83d
-kafka 0.2.1 HEAD
+kafka 0.1.0 HEAD
 kubernetes 0.1.0 f642698
-kubernetes 0.2.0 7cd7de73
-kubernetes 0.3.0 7caccec1
-kubernetes 0.4.0 6cae6ce8
-kubernetes 0.5.0 6bd2d455
-kubernetes 0.6.0 HEAD
+kubernetes 0.2.0 HEAD
 mysql 0.1.0 f642698
 mysql 0.2.0 8b975ff0
 mysql 0.3.0 HEAD
 postgres 0.1.0 f642698
-postgres 0.2.0 7cd7de73
-postgres 0.2.1 4a97e297
-postgres 0.3.0 HEAD
+postgres 0.2.0 HEAD
 rabbitmq 0.1.0 f642698
 rabbitmq 0.2.0 HEAD
 redis 0.1.1 f642698
@@ -28,11 +19,8 @@ tcp-balancer 0.2.0 HEAD
 tenant 0.1.3 3d1b86c
 tenant 0.1.4 d200480
 tenant 0.1.5 e3ab858
-tenant 1.0.0 7cd7de7
-tenant 1.1.0 4da8ac3b
-tenant 1.2.0 HEAD
+tenant 1.0.0 HEAD
 virtual-machine 0.1.4 f2015d6
-virtual-machine 0.1.5 7cd7de7
-virtual-machine 0.2.0 HEAD
+virtual-machine 0.1.5 HEAD
 vpn 0.1.0 f642698
 vpn 0.2.0 HEAD
--- a/packages/apps/virtual-machine/Chart.yaml
+++ b/packages/apps/virtual-machine/Chart.yaml
@@ -17,7 +17,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.2.0
+version: 0.1.5

 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
--- a/packages/apps/virtual-machine/Makefile
+++ b/packages/apps/virtual-machine/Makefile
@@ -1,7 +0,0 @@
-generate:
-	readme-generator -v values.yaml -s values.schema.json.tmp -r README.md
-	cat values.schema.json.tmp | \
-		jq '.properties.image.enum = ["ubuntu", "cirros", "alpine", "fedora"]' | \
-		jq '.properties.resources.properties.memory["x-display"] = "slider"' \
-		> values.schema.json
-	rm -f values.schema.json.tmp
--- a/packages/apps/virtual-machine/README.md
+++ b/packages/apps/virtual-machine/README.md
@@ -8,17 +8,3 @@ The virtual machine is managed and hosted through KubeVirt, allowing you to harn

 - Docs: https://kubevirt.io/user-guide/
 - GitHub: https://github.com/kubevirt/kubevirt
-
-## Parameters
-
-### Common parameters
-
-| Name               | Description                                                                                       | Value    |
-| ------------------ | ------------------------------------------------------------------------------------------------- | -------- |
-| `external`         | Enable external access from outside the cluster                                                   | `false`  |
-| `running`          | Determines if the virtual machine should be running                                               | `true`   |
-| `password`         | The default password for the virtual machine                                                      | `hackme` |
-| `image`            | The base image for the virtual machine. Allowed values: `ubuntu`, `cirros`, `alpine` and `fedora` | `ubuntu` |
-| `disk`             | The size of the disk allocated for the virtual machine                                            | `5Gi`    |
-| `resources.cpu`    | The number of CPU cores allocated to the virtual machine                                          | `1`      |
-| `resources.memory` | The amount of memory allocated to the virtual machine                                             | `1024M`  |
--- a/packages/apps/virtual-machine/values.schema.json
+++ b/packages/apps/virtual-machine/values.schema.json
@@ -1,51 +1,44 @@
 {
-  "title": "Chart Values",
+  "$schema": "http://json-schema.org/schema#",
  "type": "object",
  "properties": {
-    "external": {
-      "type": "boolean",
-      "description": "Enable external access from outside the cluster",
-      "default": false
-    },
    "running": {
      "type": "boolean",
-      "description": "Determines if the virtual machine should be running",
-      "default": true
+      "title": "Running"
    },
-    "password": {
-      "type": "string",
-      "description": "The default password for the virtual machine",
-      "default": "hackme"
+    "external": {
+      "type": "boolean",
+      "title": "Enable external Access"
    },
    "image": {
      "type": "string",
-      "description": "The base image for the virtual machine. Allowed values: `ubuntu`, `cirros`, `alpine` and `fedora`",
-      "default": "ubuntu",
-      "enum": [
-        "ubuntu",
-        "cirros",
-        "alpine",
-        "fedora"
-      ]
+      "form": true,
+      "enum": ["ubuntu", "cirros", "alpine", "fedora"],
+      "title": "Choose image"
+    },
+    "password": {
+      "type": "string",
+      "title": "Password"
    },
    "disk": {
      "type": "string",
-      "description": "The size of the disk allocated for the virtual machine",
-      "default": "5Gi"
+      "title": "Disk Size"
    },
    "resources": {
      "type": "object",
      "properties": {
-        "cpu": {
-          "type": "number",
-          "description": "The number of CPU cores allocated to the virtual machine",
-          "default": 1
-        },
        "memory": {
          "type": "string",
-          "description": "The amount of memory allocated to the virtual machine",
-          "default": "1024M",
-          "x-display": "slider"
+          "x-display": "slider",
+          "title": "Memory",
+          "minimum": 10,
+          "maximum": 2048
+        },
+        "cpu": {
+          "type": "integer",
+          "title": "CPU",
+          "minimum": 1,
+          "maximum": 4
        }
      }
    }
--- a/packages/apps/virtual-machine/values.yaml
+++ b/packages/apps/virtual-machine/values.yaml
@@ -1,13 +1,3 @@
-## @section Common parameters
-
-## @param external Enable external access from outside the cluster
-## @param running Determines if the virtual machine should be running
-## @param password The default password for the virtual machine
-## @param image The base image for the virtual machine. Allowed values: `ubuntu`, `cirros`, `alpine` and `fedora`
-## @param disk The size of the disk allocated for the virtual machine
-## @param resources.cpu The number of CPU cores allocated to the virtual machine
-## @param resources.memory The amount of memory allocated to the virtual machine
-
 external: false
 running: true
 password: hackme
--- a/packages/apps/vpn/Makefile
+++ b/packages/apps/vpn/Makefile
@@ -1,2 +0,0 @@
-generate:
-	readme-generator -v values.yaml -s values.schema.json -r README.md
--- a/packages/apps/vpn/README.md
+++ b/packages/apps/vpn/README.md
@@ -10,18 +10,3 @@ The VPN Service is powered by the Outline Server, an advanced and user-friendly

 - Docs: https://shadowsocks.org/
 - Docs: https://github.com/Jigsaw-Code/outline-server/tree/master/src/shadowbox
-
-## Parameters
-
-### Common parameters
-
-| Name       | Description                                     | Value   |
-| ---------- | ----------------------------------------------- | ------- |
-| `external` | Enable external access from outside the cluster | `false` |
-| `replicas` | Number of VPN-server replicas                   | `2`     |
-
-### Configuration parameters
-
-| Name    | Description         | Value |
-| ------- | ------------------- | ----- |
-| `users` | Users configuration | `{}`  |
--- a/packages/apps/vpn/values.schema.json
+++ b/packages/apps/vpn/values.schema.json
@@ -1,16 +0,0 @@
-{
-    "title": "Chart Values",
-    "type": "object",
-    "properties": {
-        "external": {
-            "type": "boolean",
-            "description": "Enable external access from outside the cluster",
-            "default": false
-        },
-        "replicas": {
-            "type": "number",
-            "description": "Number of VPN-server replicas",
-            "default": 2
-        }
-    }
-}
--- a/packages/apps/vpn/values.yaml
+++ b/packages/apps/vpn/values.yaml
@@ -1,18 +1,8 @@
-## @section Common parameters
-
-## @param external Enable external access from outside the cluster
-## @param replicas Number of VPN-server replicas
-##
 external: false
 replicas: 2

-## @section Configuration parameters
-
-## @param users [object] Users configuration
-## Example:
-## users:
-##   user1:
-##     password: hackme
-##   user2:
-##     password: tttt
-users: {}
+users:
+  user1:
+    password: hackme
+  user2:
+    password: tttt
--- a/packages/system/fluxcd-operator/.helmignore
+++ b/packages/system/fluxcd-operator/.helmignore
--- a/packages/system/fluxcd/Chart.yaml
+++ b/packages/system/fluxcd/Chart.yaml
--- a/packages/core/fluxcd/Makefile
+++ b/packages/core/fluxcd/Makefile
@@ -0,0 +1,13 @@
+NAME=fluxcd
+NAMESPACE=cozy-$(NAME)
+
+API_VERSIONS_FLAGS=$(addprefix -a ,$(shell kubectl api-versions))
+
+show:
+	helm template -n $(NAMESPACE) $(NAME) . --no-hooks --dry-run=server $(API_VERSIONS_FLAGS)
+
+apply:
+	helm template -n $(NAMESPACE) $(NAME) . --no-hooks --dry-run=server $(API_VERSIONS_FLAGS) | kubectl apply -n $(NAMESPACE) -f-
+
+diff:
+	helm template -n $(NAMESPACE) $(NAME) . --no-hooks --dry-run=server $(API_VERSIONS_FLAGS) | kubectl diff -n $(NAMESPACE) -f-
--- a/packages/system/fluxcd-operator/charts/flux-operator/.helmignore
+++ b/packages/system/fluxcd-operator/charts/flux-operator/.helmignore
@@ -21,4 +21,5 @@
 .idea/
 *.tmproj
 .vscode/
-helmdocs.gotmpl
+
+tests/
--- a/packages/core/fluxcd/charts/flux2/Chart.yaml
+++ b/packages/core/fluxcd/charts/flux2/Chart.yaml
@@ -0,0 +1,11 @@
+annotations:
+  artifacthub.io/changes: |
+    - "[Chore]: Update App Version to upstream 2.2.3"
+apiVersion: v2
+appVersion: 2.2.3
+description: A Helm chart for flux2
+name: flux2
+sources:
+- https://github.com/fluxcd-community/helm-charts
+type: application
+version: 2.12.4
--- a/packages/core/fluxcd/charts/flux2/README.md
+++ b/packages/core/fluxcd/charts/flux2/README.md
@@ -0,0 +1,174 @@
+# flux2
+
+![Version: 2.12.4](https://img.shields.io/badge/Version-2.12.4-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 2.2.3](https://img.shields.io/badge/AppVersion-2.2.3-informational?style=flat-square)
+
+A Helm chart for flux2
+
+This helm chart is maintained and released by the fluxcd-community on a best effort basis.
+
+## Source Code
+
+* <https://github.com/fluxcd-community/helm-charts>
+
+## Values
+
+| Key | Type | Default | Description |
+|-----|------|---------|-------------|
+| cli.affinity | object | `{}` |  |
+| cli.annotations | object | `{}` |  |
+| cli.image | string | `"ghcr.io/fluxcd/flux-cli"` |  |
+| cli.nodeSelector | object | `{}` |  |
+| cli.serviceAccount.automount | bool | `true` |  |
+| cli.tag | string | `"v2.2.3"` |  |
+| cli.tolerations | list | `[]` |  |
+| clusterDomain | string | `"cluster.local"` |  |
+| crds.annotations | object | `{}` | Add annotations to all CRD resources, e.g. "helm.sh/resource-policy": keep |
+| extraObjects | list | `[]` | Array of extra K8s manifests to deploy |
+| helmController.affinity | object | `{}` |  |
+| helmController.annotations."prometheus.io/port" | string | `"8080"` |  |
+| helmController.annotations."prometheus.io/scrape" | string | `"true"` |  |
+| helmController.container.additionalArgs | list | `[]` |  |
+| helmController.create | bool | `true` |  |
+| helmController.extraEnv | list | `[]` |  |
+| helmController.image | string | `"ghcr.io/fluxcd/helm-controller"` |  |
+| helmController.imagePullPolicy | string | `""` |  |
+| helmController.labels | object | `{}` |  |
+| helmController.nodeSelector | object | `{}` |  |
+| helmController.priorityClassName | string | `""` |  |
+| helmController.resources.limits | object | `{}` |  |
+| helmController.resources.requests.cpu | string | `"100m"` |  |
+| helmController.resources.requests.memory | string | `"64Mi"` |  |
+| helmController.serviceAccount.annotations | object | `{}` |  |
+| helmController.serviceAccount.automount | bool | `true` |  |
+| helmController.serviceAccount.create | bool | `true` |  |
+| helmController.tag | string | `"v0.37.4"` |  |
+| helmController.tolerations | list | `[]` |  |
+| imageAutomationController.affinity | object | `{}` |  |
+| imageAutomationController.annotations."prometheus.io/port" | string | `"8080"` |  |
+| imageAutomationController.annotations."prometheus.io/scrape" | string | `"true"` |  |
+| imageAutomationController.container.additionalArgs | list | `[]` |  |
+| imageAutomationController.create | bool | `true` |  |
+| imageAutomationController.extraEnv | list | `[]` |  |
+| imageAutomationController.image | string | `"ghcr.io/fluxcd/image-automation-controller"` |  |
+| imageAutomationController.imagePullPolicy | string | `""` |  |
+| imageAutomationController.labels | object | `{}` |  |
+| imageAutomationController.nodeSelector | object | `{}` |  |
+| imageAutomationController.priorityClassName | string | `""` |  |
+| imageAutomationController.resources.limits | object | `{}` |  |
+| imageAutomationController.resources.requests.cpu | string | `"100m"` |  |
+| imageAutomationController.resources.requests.memory | string | `"64Mi"` |  |
+| imageAutomationController.serviceAccount.annotations | object | `{}` |  |
+| imageAutomationController.serviceAccount.automount | bool | `true` |  |
+| imageAutomationController.serviceAccount.create | bool | `true` |  |
+| imageAutomationController.tag | string | `"v0.37.1"` |  |
+| imageAutomationController.tolerations | list | `[]` |  |
+| imagePullSecrets | list | `[]` | contents of pod imagePullSecret in form 'name=[secretName]'; applied to all controllers |
+| imageReflectionController.affinity | object | `{}` |  |
+| imageReflectionController.annotations."prometheus.io/port" | string | `"8080"` |  |
+| imageReflectionController.annotations."prometheus.io/scrape" | string | `"true"` |  |
+| imageReflectionController.container.additionalArgs | list | `[]` |  |
+| imageReflectionController.create | bool | `true` |  |
+| imageReflectionController.extraEnv | list | `[]` |  |
+| imageReflectionController.image | string | `"ghcr.io/fluxcd/image-reflector-controller"` |  |
+| imageReflectionController.imagePullPolicy | string | `""` |  |
+| imageReflectionController.labels | object | `{}` |  |
+| imageReflectionController.nodeSelector | object | `{}` |  |
+| imageReflectionController.priorityClassName | string | `""` |  |
+| imageReflectionController.resources.limits | object | `{}` |  |
+| imageReflectionController.resources.requests.cpu | string | `"100m"` |  |
+| imageReflectionController.resources.requests.memory | string | `"64Mi"` |  |
+| imageReflectionController.serviceAccount.annotations | object | `{}` |  |
+| imageReflectionController.serviceAccount.automount | bool | `true` |  |
+| imageReflectionController.serviceAccount.create | bool | `true` |  |
+| imageReflectionController.tag | string | `"v0.31.2"` |  |
+| imageReflectionController.tolerations | list | `[]` |  |
+| installCRDs | bool | `true` |  |
+| kustomizeController.affinity | object | `{}` |  |
+| kustomizeController.annotations."prometheus.io/port" | string | `"8080"` |  |
+| kustomizeController.annotations."prometheus.io/scrape" | string | `"true"` |  |
+| kustomizeController.container.additionalArgs | list | `[]` |  |
+| kustomizeController.create | bool | `true` |  |
+| kustomizeController.envFrom | object | `{"map":{"name":""},"secret":{"name":""}}` | Defines envFrom using a configmap and/or secret. |
+| kustomizeController.extraEnv | list | `[]` |  |
+| kustomizeController.extraSecretMounts | list | `[]` | Defines additional mounts with secrets. Secrets must be manually created in the namespace or with kustomizeController.secret |
+| kustomizeController.image | string | `"ghcr.io/fluxcd/kustomize-controller"` |  |
+| kustomizeController.imagePullPolicy | string | `""` |  |
+| kustomizeController.labels | object | `{}` |  |
+| kustomizeController.nodeSelector | object | `{}` |  |
+| kustomizeController.priorityClassName | string | `""` |  |
+| kustomizeController.resources.limits | object | `{}` |  |
+| kustomizeController.resources.requests.cpu | string | `"100m"` |  |
+| kustomizeController.resources.requests.memory | string | `"64Mi"` |  |
+| kustomizeController.secret.create | bool | `false` | Create a secret to use it with extraSecretMounts. Defaults to false. |
+| kustomizeController.secret.data | object | `{}` |  |
+| kustomizeController.secret.name | string | `""` |  |
+| kustomizeController.serviceAccount.annotations | object | `{}` |  |
+| kustomizeController.serviceAccount.automount | bool | `true` |  |
+| kustomizeController.serviceAccount.create | bool | `true` |  |
+| kustomizeController.tag | string | `"v1.2.2"` |  |
+| kustomizeController.tolerations | list | `[]` |  |
+| logLevel | string | `"info"` |  |
+| multitenancy.defaultServiceAccount | string | `"default"` | All Kustomizations and HelmReleases which don’t have spec.serviceAccountName specified, will use the default account from the tenant’s namespace. Tenants have to specify a service account in their Flux resources to be able to deploy workloads in their namespaces as the default account has no permissions. |
+| multitenancy.enabled | bool | `false` | Implement the patches for Multi-tenancy lockdown. See https://fluxcd.io/docs/installation/#multi-tenancy-lockdown |
+| multitenancy.privileged | bool | `true` | Both kustomize-controller and helm-controller service accounts run privileged with cluster-admin ClusterRoleBinding. Disable if you want to run them with a minimum set of permissions. |
+| notificationController.affinity | object | `{}` |  |
+| notificationController.annotations."prometheus.io/port" | string | `"8080"` |  |
+| notificationController.annotations."prometheus.io/scrape" | string | `"true"` |  |
+| notificationController.container.additionalArgs | list | `[]` |  |
+| notificationController.create | bool | `true` |  |
+| notificationController.extraEnv | list | `[]` |  |
+| notificationController.image | string | `"ghcr.io/fluxcd/notification-controller"` |  |
+| notificationController.imagePullPolicy | string | `""` |  |
+| notificationController.labels | object | `{}` |  |
+| notificationController.nodeSelector | object | `{}` |  |
+| notificationController.priorityClassName | string | `""` |  |
+| notificationController.resources.limits | object | `{}` |  |
+| notificationController.resources.requests.cpu | string | `"100m"` |  |
+| notificationController.resources.requests.memory | string | `"64Mi"` |  |
+| notificationController.service.annotations | object | `{}` |  |
+| notificationController.service.labels | object | `{}` |  |
+| notificationController.serviceAccount.annotations | object | `{}` |  |
+| notificationController.serviceAccount.automount | bool | `true` |  |
+| notificationController.serviceAccount.create | bool | `true` |  |
+| notificationController.tag | string | `"v1.2.4"` |  |
+| notificationController.tolerations | list | `[]` |  |
+| notificationController.webhookReceiver.ingress.annotations | object | `{}` |  |
+| notificationController.webhookReceiver.ingress.create | bool | `false` |  |
+| notificationController.webhookReceiver.ingress.hosts[0].host | string | `"flux-webhook.example.com"` |  |
+| notificationController.webhookReceiver.ingress.hosts[0].paths[0].path | string | `"/"` |  |
+| notificationController.webhookReceiver.ingress.hosts[0].paths[0].pathType | string | `"ImplementationSpecific"` |  |
+| notificationController.webhookReceiver.ingress.labels | object | `{}` |  |
+| notificationController.webhookReceiver.ingress.tls | list | `[]` |  |
+| notificationController.webhookReceiver.service.annotations | object | `{}` |  |
+| notificationController.webhookReceiver.service.labels | object | `{}` |  |
+| policies.create | bool | `true` |  |
+| prometheus.podMonitor.create | bool | `false` | Enables podMonitor endpoint |
+| prometheus.podMonitor.podMetricsEndpoints[0].port | string | `"http-prom"` |  |
+| prometheus.podMonitor.podMetricsEndpoints[0].relabelings[0].action | string | `"keep"` |  |
+| prometheus.podMonitor.podMetricsEndpoints[0].relabelings[0].regex | string | `"Running"` |  |
+| prometheus.podMonitor.podMetricsEndpoints[0].relabelings[0].sourceLabels[0] | string | `"__meta_kubernetes_pod_phase"` |  |
+| rbac.annotations | object | `{}` | Add annotations to all RBAC resources, e.g. "helm.sh/resource-policy": keep |
+| rbac.create | bool | `true` |  |
+| rbac.createAggregation | bool | `true` | Grant the Kubernetes view, edit and admin roles access to Flux custom resources |
+| sourceController.affinity | object | `{}` |  |
+| sourceController.annotations."prometheus.io/port" | string | `"8080"` |  |
+| sourceController.annotations."prometheus.io/scrape" | string | `"true"` |  |
+| sourceController.container.additionalArgs | list | `[]` |  |
+| sourceController.create | bool | `true` |  |
+| sourceController.extraEnv | list | `[]` |  |
+| sourceController.image | string | `"ghcr.io/fluxcd/source-controller"` |  |
+| sourceController.imagePullPolicy | string | `""` |  |
+| sourceController.labels | object | `{}` |  |
+| sourceController.nodeSelector | object | `{}` |  |
+| sourceController.priorityClassName | string | `""` |  |
+| sourceController.resources.limits | object | `{}` |  |
+| sourceController.resources.requests.cpu | string | `"100m"` |  |
+| sourceController.resources.requests.memory | string | `"64Mi"` |  |
+| sourceController.service.annotations | object | `{}` |  |
+| sourceController.service.labels | object | `{}` |  |
+| sourceController.serviceAccount.annotations | object | `{}` |  |
+| sourceController.serviceAccount.automount | bool | `true` |  |
+| sourceController.serviceAccount.create | bool | `true` |  |
+| sourceController.tag | string | `"v1.2.4"` |  |
+| sourceController.tolerations | list | `[]` |  |
+| watchAllNamespaces | bool | `true` |  |
--- a/packages/core/fluxcd/charts/flux2/templates/_helper.tpl
+++ b/packages/core/fluxcd/charts/flux2/templates/_helper.tpl
@@ -0,0 +1,7 @@
+{{- define "template.image" -}}
+{{- if eq (substr 0 7 .tag) "sha256:" -}}
+{{- printf "%s@%s" .image .tag -}}
+{{- else -}}
+{{- printf "%s:%s" .image .tag -}}
+{{- end -}}
+{{- end -}}
--- a/packages/core/fluxcd/charts/flux2/templates/aggregate-clusterroles.yaml
+++ b/packages/core/fluxcd/charts/flux2/templates/aggregate-clusterroles.yaml
@@ -0,0 +1,47 @@
+{{- if .Values.rbac.createAggregation }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  {{- with .Values.rbac.annotations }}
+  annotations: {{ toYaml . | nindent 4 }}
+  {{- end }}
+  name: flux-edit
+  labels:
+    rbac.authorization.k8s.io/aggregate-to-edit: "true"
+    rbac.authorization.k8s.io/aggregate-to-admin: "true"
+rules:
+  - apiGroups:
+      - notification.toolkit.fluxcd.io
+      - source.toolkit.fluxcd.io
+      - helm.toolkit.fluxcd.io
+      - image.toolkit.fluxcd.io
+      - kustomize.toolkit.fluxcd.io
+    resources: ["*"]
+    verbs:
+      - create
+      - delete
+      - deletecollection
+      - patch
+      - update
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: flux-view
+  labels:
+    rbac.authorization.k8s.io/aggregate-to-admin: "true"
+    rbac.authorization.k8s.io/aggregate-to-edit: "true"
+    rbac.authorization.k8s.io/aggregate-to-view: "true"
+rules:
+  - apiGroups:
+      - notification.toolkit.fluxcd.io
+      - source.toolkit.fluxcd.io
+      - helm.toolkit.fluxcd.io
+      - image.toolkit.fluxcd.io
+      - kustomize.toolkit.fluxcd.io
+    resources: ["*"]
+    verbs:
+      - get
+      - list
+      - watch
+{{- end }}
--- a/packages/core/fluxcd/charts/flux2/templates/cluster-reconciler-clusterrolebinding.yaml
+++ b/packages/core/fluxcd/charts/flux2/templates/cluster-reconciler-clusterrolebinding.yaml
@@ -0,0 +1,26 @@
+{{- if and .Values.rbac.create (or (not .Values.multitenancy.enabled) .Values.multitenancy.privileged) }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  {{- with .Values.rbac.annotations }}
+  annotations: {{ toYaml . | nindent 4 }}
+  {{- end }}
+  labels:
+    app.kubernetes.io/instance: {{ .Release.Namespace | quote }}
+    app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
+    app.kubernetes.io/version: {{ .Chart.AppVersion | quote  }}
+    app.kubernetes.io/part-of: flux
+    helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
+  name: cluster-reconciler
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ .Values.rbac.roleRef.name }}
+subjects:
+- kind: ServiceAccount
+  name: kustomize-controller
+  namespace: {{ .Release.Namespace }}
+- kind: ServiceAccount
+  name: helm-controller
+  namespace: {{ .Release.Namespace }}
+{{- end }}
--- a/packages/core/fluxcd/charts/flux2/templates/cluster-reconciler-impersonator-clusterrole.yaml
+++ b/packages/core/fluxcd/charts/flux2/templates/cluster-reconciler-impersonator-clusterrole.yaml
@@ -0,0 +1,19 @@
+{{- if and .Values.rbac.create .Values.multitenancy.enabled (not .Values.multitenancy.privileged) }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  {{- with .Values.rbac.annotations }}
+  annotations: {{ toYaml . | nindent 4 }}
+  {{- end }}
+  name: cluster-reconciler-impersonator
+  labels:
+    app.kubernetes.io/instance: {{ .Release.Namespace | quote }}
+    app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
+    app.kubernetes.io/version: {{ .Chart.AppVersion | quote  }}
+    app.kubernetes.io/part-of: flux
+    helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
+rules:
+- apiGroups: [""]
+  resources: ["serviceaccounts"]
+  verbs: ["impersonate"]
+{{- end }}
--- a/packages/core/fluxcd/charts/flux2/templates/cluster-reconciler-impersonator-clusterrolebinding.yaml
+++ b/packages/core/fluxcd/charts/flux2/templates/cluster-reconciler-impersonator-clusterrolebinding.yaml
@@ -0,0 +1,26 @@
+{{- if and .Values.rbac.create .Values.multitenancy.enabled (not .Values.multitenancy.privileged) }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  {{- with .Values.rbac.annotations }}
+  annotations: {{ toYaml . | nindent 4 }}
+  {{- end }}
+  labels:
+    app.kubernetes.io/instance: {{ .Release.Namespace | quote }}
+    app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
+    app.kubernetes.io/version: {{ .Chart.AppVersion | quote  }}
+    app.kubernetes.io/part-of: flux
+    helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
+  name: cluster-reconciler-impersonator
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: cluster-reconciler-impersonator
+subjects:
+- kind: ServiceAccount
+  name: kustomize-controller
+  namespace: {{ .Release.Namespace }}
+- kind: ServiceAccount
+  name: helm-controller
+  namespace: {{ .Release.Namespace }}
+{{- end }}
--- a/packages/core/fluxcd/charts/flux2/templates/crd-controller-clusterrole.yaml
+++ b/packages/core/fluxcd/charts/flux2/templates/crd-controller-clusterrole.yaml
@@ -0,0 +1,82 @@
+{{- if and .Values.rbac.create }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  {{- with .Values.rbac.annotations }}
+  annotations: {{ toYaml . | nindent 4 }}
+  {{- end }}
+  name: crd-controller
+  labels:
+    app.kubernetes.io/instance: {{ .Release.Namespace | quote }}
+    app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
+    app.kubernetes.io/version: {{ .Chart.AppVersion | quote  }}
+    app.kubernetes.io/part-of: flux
+    helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
+rules:
+- apiGroups: ['source.toolkit.fluxcd.io']
+  resources: ['*']
+  verbs: ['*']
+- apiGroups: ['kustomize.toolkit.fluxcd.io']
+  resources: ['*']
+  verbs: ['*']
+- apiGroups: ['helm.toolkit.fluxcd.io']
+  resources: ['*']
+  verbs: ['*']
+- apiGroups: ['notification.toolkit.fluxcd.io']
+  resources: ['*']
+  verbs: ['*']
+- apiGroups: ['image.toolkit.fluxcd.io']
+  resources: ['*']
+  verbs: ['*']
+- apiGroups:
+  - ""
+  resources:
+  - namespaces
+  - secrets
+  - configmaps
+  - serviceaccounts
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - ""
+  resources:
+  - events
+  verbs:
+  - create
+  - patch
+# required by leader election
+- apiGroups:
+    - ""
+  resources:
+    - configmaps
+  verbs:
+    - get
+    - list
+    - watch
+    - create
+    - update
+    - patch
+    - delete
+- apiGroups:
+    - ""
+  resources:
+    - configmaps/status
+  verbs:
+    - get
+    - update
+    - patch
+- apiGroups:
+  - "coordination.k8s.io"
+  resources:
+  - leases
+  verbs:
+  - get
+  - list
+  - watch
+  - create
+  - update
+  - patch
+  - delete
+{{- end }}
--- a/packages/core/fluxcd/charts/flux2/templates/crd-controller-clusterrolebinding.yaml
+++ b/packages/core/fluxcd/charts/flux2/templates/crd-controller-clusterrolebinding.yaml
@@ -0,0 +1,38 @@
+{{- if and .Values.rbac.create }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  {{- with .Values.rbac.annotations }}
+  annotations: {{ toYaml . | nindent 4 }}
+  {{- end }}
+  name: crd-controller
+  labels:
+    app.kubernetes.io/instance: {{ .Release.Namespace | quote }}
+    app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
+    app.kubernetes.io/version: {{ .Chart.AppVersion | quote  }}
+    app.kubernetes.io/part-of: flux
+    helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: crd-controller
+subjects:
+  - kind: ServiceAccount
+    name: kustomize-controller
+    namespace: {{ .Release.Namespace }}
+  - kind: ServiceAccount
+    name: helm-controller
+    namespace: {{ .Release.Namespace }}
+  - kind: ServiceAccount
+    name: source-controller
+    namespace: {{ .Release.Namespace }}
+  - kind: ServiceAccount
+    name: notification-controller
+    namespace: {{ .Release.Namespace }}
+  - kind: ServiceAccount
+    name: image-reflector-controller
+    namespace: {{ .Release.Namespace }}
+  - kind: ServiceAccount
+    name: image-automation-controller
+    namespace: {{ .Release.Namespace }}
+{{- end }}
--- a/packages/core/fluxcd/charts/flux2/templates/extra-manifests.yaml
+++ b/packages/core/fluxcd/charts/flux2/templates/extra-manifests.yaml
@@ -0,0 +1,4 @@
+{{ range .Values.extraObjects }}
+---
+{{ tpl (toYaml .) $ }}
+{{ end }}
--- a/packages/core/fluxcd/charts/flux2/templates/helm-controller-sa.yaml
+++ b/packages/core/fluxcd/charts/flux2/templates/helm-controller-sa.yaml
@@ -0,0 +1,18 @@
+{{- if and .Values.helmController.create}}
+{{- if .Values.helmController.serviceAccount.create -}}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  labels:
+    app.kubernetes.io/component: helm-controller
+    app.kubernetes.io/instance: {{ .Release.Namespace | quote }}
+    app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
+    app.kubernetes.io/version: {{ .Chart.AppVersion | quote  }}
+    app.kubernetes.io/part-of: flux
+    helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
+  name: helm-controller
+  {{- with .Values.helmController.serviceAccount.annotations }}
+  annotations: {{ toYaml . | nindent 4 }}
+  {{- end }}
+{{- end -}}
+{{- end -}}
--- a/packages/core/fluxcd/charts/flux2/templates/helm-controller.crds.yaml
+++ b/packages/core/fluxcd/charts/flux2/templates/helm-controller.crds.yaml
--- a/packages/core/fluxcd/charts/flux2/templates/helm-controller.yaml
+++ b/packages/core/fluxcd/charts/flux2/templates/helm-controller.yaml
@@ -0,0 +1,133 @@
+{{- if and .Values.helmController.create}}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    app.kubernetes.io/component: helm-controller
+    app.kubernetes.io/instance: {{ .Release.Namespace | quote }}
+    app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
+    app.kubernetes.io/version: {{ .Chart.AppVersion | quote  }}
+    app.kubernetes.io/part-of: flux
+    helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
+    control-plane: controller
+    {{- with .Values.helmController.labels }}
+    {{- . | toYaml | nindent 4 }}
+    {{- end }}
+  name: helm-controller
+spec:
+  {{- if kindIs "invalid" .Values.helmController.replicas }}
+  replicas: 1
+  {{- else }}
+  replicas: {{ .Values.helmController.replicas  }}
+  {{- end}}
+  selector:
+    matchLabels:
+      app: helm-controller
+  template:
+    metadata:
+      {{- with .Values.helmController.annotations }}
+      annotations: {{ toYaml . | nindent 8 }}
+      {{- end }}
+      labels:
+        app: helm-controller
+{{ with .Values.helmController.labels }}{{ toYaml . | indent 8 }}{{ end }}
+    spec:
+      automountServiceAccountToken: {{ .Values.helmController.serviceAccount.automount }}
+    {{- if .Values.helmController.initContainers}}
+      initContainers:
+        {{- toYaml .Values.helmController.initContainers | nindent 8}}
+    {{- end}}
+      containers:
+      - args:
+        {{- if .Values.multitenancy.enabled }}
+        - --no-cross-namespace-refs=true
+        - --default-service-account={{ .Values.multitenancy.defaultServiceAccount | default "default"  }}
+        {{- end}}
+        {{- if .Values.notificationController.create }}
+        - --events-addr=http://notification-controller.$(RUNTIME_NAMESPACE).svc.{{ .Values.clusterDomain | default "cluster.local" }}.
+        {{- end}}
+        - --watch-all-namespaces={{ .Values.watchAllNamespaces }}
+        - --log-level={{ .Values.logLevel | default "info" }}
+        - --log-encoding=json
+        - --enable-leader-election
+        {{- range .Values.helmController.container.additionalArgs }}
+        - {{ . }}
+        {{- end}}
+        env:
+        - name: RUNTIME_NAMESPACE
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.namespace
+        {{- with .Values.helmController.extraEnv }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
+        image: {{ template "template.image" .Values.helmController }}
+        {{- if .Values.helmController.imagePullPolicy }}
+        imagePullPolicy: {{ .Values.helmController.imagePullPolicy }}
+        {{- else }}
+        imagePullPolicy: IfNotPresent
+        {{- end }}
+        livenessProbe:
+          httpGet:
+            path: /healthz
+            port: healthz
+        name: manager
+        ports:
+        - containerPort: 8080
+          name: http-prom
+        - containerPort: 9440
+          name: healthz
+          protocol: TCP
+        readinessProbe:
+          httpGet:
+            path: /readyz
+            port: healthz
+        {{- with .Values.helmController.resources }}
+        resources: {{ toYaml . | nindent 10 }}
+        {{- end }}
+        {{- if .Values.helmController.securityContext }}
+        securityContext: {{ toYaml .Values.helmController.securityContext | nindent 10 }}
+        {{- else }}
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+          readOnlyRootFilesystem: true
+          runAsNonRoot: true
+          seccompProfile:
+            type: RuntimeDefault
+        {{- end}}
+        volumeMounts:
+        - mountPath: /tmp
+          name: temp
+        {{- if .Values.helmController.volumeMounts }}
+        {{- toYaml .Values.helmController.volumeMounts | nindent 8 }}
+        {{- end}}
+      {{- if .Values.helmController.priorityClassName }}
+      priorityClassName: {{ .Values.helmController.priorityClassName | quote }}
+      {{- end }}
+      {{- if .Values.helmController.podSecurityContext }}
+      securityContext: {{ toYaml .Values.helmController.podSecurityContext | nindent 8 }}
+      {{- end }}
+      serviceAccountName: helm-controller
+      {{- if .Values.imagePullSecrets }}
+      imagePullSecrets: {{ toYaml .Values.imagePullSecrets | nindent 6 }}
+      {{- end }}
+      terminationGracePeriodSeconds: 600
+      volumes:
+      - emptyDir: {}
+        name: temp
+      {{- if .Values.helmController.volumes }}
+      {{- toYaml .Values.helmController.volumes | nindent 6 }}
+      {{- end}}
+      {{- with .Values.helmController.nodeSelector }}
+      nodeSelector: {{ toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.helmController.affinity }}
+      affinity: {{ toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.helmController.tolerations }}
+      tolerations: {{ toYaml . | nindent 8 }}
+      {{- end }}
+{{- end }}
--- a/packages/core/fluxcd/charts/flux2/templates/image-automation-controller-sa.yaml
+++ b/packages/core/fluxcd/charts/flux2/templates/image-automation-controller-sa.yaml
@@ -0,0 +1,18 @@
+{{- if and .Values.imageAutomationController.create }}
+{{- if .Values.imageAutomationController.serviceAccount.create -}}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  labels:
+    app.kubernetes.io/component: image-automation-controller
+    app.kubernetes.io/instance: {{ .Release.Namespace | quote }}
+    app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
+    app.kubernetes.io/version: {{ .Chart.AppVersion | quote  }}
+    app.kubernetes.io/part-of: flux
+    helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
+  name: image-automation-controller
+  {{- with .Values.imageAutomationController.serviceAccount.annotations }}
+  annotations: {{ toYaml . | nindent 4 }}
+  {{- end }}
+{{- end -}}
+{{- end -}}
--- a/packages/core/fluxcd/charts/flux2/templates/image-automation-controller.crds.yaml
+++ b/packages/core/fluxcd/charts/flux2/templates/image-automation-controller.crds.yaml
@@ -0,0 +1,326 @@
+{{- if and .Values.installCRDs .Values.imageAutomationController.create }}
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.12.0
+    {{- with .Values.crds.annotations }}
+    {{- . | toYaml | nindent 4 }}
+    {{- end }}
+  labels:
+    app.kubernetes.io/component: image-automation-controller
+    app.kubernetes.io/instance: '{{ .Release.Namespace }}'
+    app.kubernetes.io/managed-by: '{{ .Release.Service }}'
+    app.kubernetes.io/part-of: flux
+    app.kubernetes.io/version: '{{ .Chart.AppVersion }}'
+    helm.sh/chart: '{{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}'
+  name: imageupdateautomations.image.toolkit.fluxcd.io
+spec:
+  group: image.toolkit.fluxcd.io
+  names:
+    kind: ImageUpdateAutomation
+    listKind: ImageUpdateAutomationList
+    plural: imageupdateautomations
+    singular: imageupdateautomation
+  scope: Namespaced
+  versions:
+  - additionalPrinterColumns:
+    - jsonPath: .status.lastAutomationRunTime
+      name: Last run
+      type: string
+    name: v1beta1
+    schema:
+      openAPIV3Schema:
+        description: ImageUpdateAutomation is the Schema for the imageupdateautomations
+          API
+        properties:
+          apiVersion:
+            description: 'APIVersion defines the versioned schema of this representation
+              of an object. Servers should convert recognized schemas to the latest
+              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+            type: string
+          kind:
+            description: 'Kind is a string value representing the REST resource this
+              object represents. Servers may infer this from the endpoint the client
+              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: ImageUpdateAutomationSpec defines the desired state of ImageUpdateAutomation
+            properties:
+              git:
+                description: GitSpec contains all the git-specific definitions. This
+                  is technically optional, but in practice mandatory until there are
+                  other kinds of source allowed.
+                properties:
+                  checkout:
+                    description: Checkout gives the parameters for cloning the git
+                      repository, ready to make changes. If not present, the `spec.ref`
+                      field from the referenced `GitRepository` or its default will
+                      be used.
+                    properties:
+                      ref:
+                        description: Reference gives a branch, tag or commit to clone
+                          from the Git repository.
+                        properties:
+                          branch:
+                            description: Branch to check out, defaults to 'master'
+                              if no other field is defined.
+                            type: string
+                          commit:
+                            description: "Commit SHA to check out, takes precedence
+                              over all reference fields. \n This can be combined with
+                              Branch to shallow clone the branch, in which the commit
+                              is expected to exist."
+                            type: string
+                          name:
+                            description: "Name of the reference to check out; takes
+                              precedence over Branch, Tag and SemVer. \n It must be
+                              a valid Git reference: https://git-scm.com/docs/git-check-ref-format#_description
+                              Examples: \"refs/heads/main\", \"refs/tags/v0.1.0\",
+                              \"refs/pull/420/head\", \"refs/merge-requests/1/head\""
+                            type: string
+                          semver:
+                            description: SemVer tag expression to check out, takes
+                              precedence over Tag.
+                            type: string
+                          tag:
+                            description: Tag to check out, takes precedence over Branch.
+                            type: string
+                        type: object
+                    required:
+                    - ref
+                    type: object
+                  commit:
+                    description: Commit specifies how to commit to the git repository.
+                    properties:
+                      author:
+                        description: Author gives the email and optionally the name
+                          to use as the author of commits.
+                        properties:
+                          email:
+                            description: Email gives the email to provide when making
+                              a commit.
+                            type: string
+                          name:
+                            description: Name gives the name to provide when making
+                              a commit.
+                            type: string
+                        required:
+                        - email
+                        type: object
+                      messageTemplate:
+                        description: MessageTemplate provides a template for the commit
+                          message, into which will be interpolated the details of
+                          the change made.
+                        type: string
+                      signingKey:
+                        description: SigningKey provides the option to sign commits
+                          with a GPG key
+                        properties:
+                          secretRef:
+                            description: SecretRef holds the name to a secret that
+                              contains a 'git.asc' key corresponding to the ASCII
+                              Armored file containing the GPG signing keypair as the
+                              value. It must be in the same namespace as the ImageUpdateAutomation.
+                            properties:
+                              name:
+                                description: Name of the referent.
+                                type: string
+                            required:
+                            - name
+                            type: object
+                        type: object
+                    required:
+                    - author
+                    type: object
+                  push:
+                    description: Push specifies how and where to push commits made
+                      by the automation. If missing, commits are pushed (back) to
+                      `.spec.checkout.branch` or its default.
+                    properties:
+                      branch:
+                        description: Branch specifies that commits should be pushed
+                          to the branch named. The branch is created using `.spec.checkout.branch`
+                          as the starting point, if it doesn't already exist.
+                        type: string
+                      options:
+                        additionalProperties:
+                          type: string
+                        description: 'Options specifies the push options that are
+                          sent to the Git server when performing a push operation.
+                          For details, see: https://git-scm.com/docs/git-push#Documentation/git-push.txt---push-optionltoptiongt'
+                        type: object
+                      refspec:
+                        description: 'Refspec specifies the Git Refspec to use for
+                          a push operation. If both Branch and Refspec are provided,
+                          then the commit is pushed to the branch and also using the
+                          specified refspec. For more details about Git Refspecs,
+                          see: https://git-scm.com/book/en/v2/Git-Internals-The-Refspec'
+                        type: string
+                    type: object
+                required:
+                - commit
+                type: object
+              interval:
+                description: Interval gives an lower bound for how often the automation
+                  run should be attempted.
+                pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$
+                type: string
+              sourceRef:
+                description: SourceRef refers to the resource giving access details
+                  to a git repository.
+                properties:
+                  apiVersion:
+                    description: API version of the referent.
+                    type: string
+                  kind:
+                    default: GitRepository
+                    description: Kind of the referent.
+                    enum:
+                    - GitRepository
+                    type: string
+                  name:
+                    description: Name of the referent.
+                    type: string
+                  namespace:
+                    description: Namespace of the referent, defaults to the namespace
+                      of the Kubernetes resource object that contains the reference.
+                    type: string
+                required:
+                - kind
+                - name
+                type: object
+              suspend:
+                description: Suspend tells the controller to not run this automation,
+                  until it is unset (or set to false). Defaults to false.
+                type: boolean
+              update:
+                default:
+                  strategy: Setters
+                description: Update gives the specification for how to update the
+                  files in the repository. This can be left empty, to use the default
+                  value.
+                properties:
+                  path:
+                    description: Path to the directory containing the manifests to
+                      be updated. Defaults to 'None', which translates to the root
+                      path of the GitRepositoryRef.
+                    type: string
+                  strategy:
+                    default: Setters
+                    description: Strategy names the strategy to be used.
+                    enum:
+                    - Setters
+                    type: string
+                required:
+                - strategy
+                type: object
+            required:
+            - interval
+            - sourceRef
+            type: object
+          status:
+            default:
+              observedGeneration: -1
+            description: ImageUpdateAutomationStatus defines the observed state of
+              ImageUpdateAutomation
+            properties:
+              conditions:
+                items:
+                  description: "Condition contains details for one aspect of the current
+                    state of this API Resource. --- This struct is intended for direct
+                    use as an array at the field path .status.conditions.  For example,
+                    \n type FooStatus struct{ // Represents the observations of a
+                    foo's current state. // Known .status.conditions.type are: \"Available\",
+                    \"Progressing\", and \"Degraded\" // +patchMergeKey=type // +patchStrategy=merge
+                    // +listType=map // +listMapKey=type Conditions []metav1.Condition
+                    `json:\"conditions,omitempty\" patchStrategy:\"merge\" patchMergeKey:\"type\"
+                    protobuf:\"bytes,1,rep,name=conditions\"` \n // other fields }"
+                  properties:
+                    lastTransitionTime:
+                      description: lastTransitionTime is the last time the condition
+                        transitioned from one status to another. This should be when
+                        the underlying condition changed.  If that is not known, then
+                        using the time when the API field changed is acceptable.
+                      format: date-time
+                      type: string
+                    message:
+                      description: message is a human readable message indicating
+                        details about the transition. This may be an empty string.
+                      maxLength: 32768
+                      type: string
+                    observedGeneration:
+                      description: observedGeneration represents the .metadata.generation
+                        that the condition was set based upon. For instance, if .metadata.generation
+                        is currently 12, but the .status.conditions[x].observedGeneration
+                        is 9, the condition is out of date with respect to the current
+                        state of the instance.
+                      format: int64
+                      minimum: 0
+                      type: integer
+                    reason:
+                      description: reason contains a programmatic identifier indicating
+                        the reason for the condition's last transition. Producers
+                        of specific condition types may define expected values and
+                        meanings for this field, and whether the values are considered
+                        a guaranteed API. The value should be a CamelCase string.
+                        This field may not be empty.
+                      maxLength: 1024
+                      minLength: 1
+                      pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
+                      type: string
+                    status:
+                      description: status of the condition, one of True, False, Unknown.
+                      enum:
+                      - "True"
+                      - "False"
+                      - Unknown
+                      type: string
+                    type:
+                      description: type of condition in CamelCase or in foo.example.com/CamelCase.
+                        --- Many .condition.type values are consistent across resources
+                        like Available, but because arbitrary conditions can be useful
+                        (see .node.status.conditions), the ability to deconflict is
+                        important. The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)
+                      maxLength: 316
+                      pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
+                      type: string
+                  required:
+                  - lastTransitionTime
+                  - message
+                  - reason
+                  - status
+                  - type
+                  type: object
+                type: array
+              lastAutomationRunTime:
+                description: LastAutomationRunTime records the last time the controller
+                  ran this automation through to completion (even if no updates were
+                  made).
+                format: date-time
+                type: string
+              lastHandledReconcileAt:
+                description: LastHandledReconcileAt holds the value of the most recent
+                  reconcile request value, so a change of the annotation value can
+                  be detected.
+                type: string
+              lastPushCommit:
+                description: LastPushCommit records the SHA1 of the last commit made
+                  by the controller, for this automation object
+                type: string
+              lastPushTime:
+                description: LastPushTime records the time of the last pushed change.
+                format: date-time
+                type: string
+              observedGeneration:
+                format: int64
+                type: integer
+            type: object
+        type: object
+    served: true
+    storage: true
+    subresources:
+      status: {}
+{{- end }}
--- a/packages/core/fluxcd/charts/flux2/templates/image-automation-controller.yaml
+++ b/packages/core/fluxcd/charts/flux2/templates/image-automation-controller.yaml
@@ -0,0 +1,135 @@
+{{- if and .Values.imageAutomationController.create}}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    app.kubernetes.io/component: image-automation-controller
+    app.kubernetes.io/instance: {{ .Release.Namespace | quote }}
+    app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
+    app.kubernetes.io/version: {{ .Chart.AppVersion | quote  }}
+    app.kubernetes.io/part-of: flux
+    helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
+    control-plane: controller
+    {{- with .Values.imageAutomationController.labels }}
+    {{- . | toYaml | nindent 4 }}
+    {{- end }}
+  name: image-automation-controller
+spec:
+  {{- if kindIs "invalid" .Values.imageAutomationController.replicas }}
+  replicas: 1
+  {{- else }}
+  replicas: {{ .Values.imageAutomationController.replicas  }}
+  {{- end}}
+  selector:
+    matchLabels:
+      app: image-automation-controller
+  template:
+    metadata:
+      {{- with .Values.imageAutomationController.annotations }}
+      annotations: {{ toYaml . | nindent 8 }}
+      {{- end }}
+      labels:
+        app: image-automation-controller
+{{ with .Values.imageAutomationController.labels }}{{ toYaml . | indent 8 }}{{ end }}
+    spec:
+      automountServiceAccountToken: {{ .Values.imageAutomationController.serviceAccount.automount }}
+      {{- if .Values.imageAutomationController.initContainers}}
+      initContainers:
+        {{- toYaml .Values.imageAutomationController.initContainers | nindent 8}}
+      {{- end}}
+      containers:
+      - args:
+        {{- if .Values.multitenancy.enabled }}
+        - --no-cross-namespace-refs=true
+        {{- end}}
+        {{- if .Values.notificationController.create }}
+        - --events-addr=http://notification-controller.$(RUNTIME_NAMESPACE).svc.{{ .Values.clusterDomain | default "cluster.local" }}.
+        {{- end}}
+        - --watch-all-namespaces={{ .Values.watchAllNamespaces }}
+        - --log-level={{ .Values.logLevel | default "info" }}
+        - --log-encoding=json
+        - --enable-leader-election
+        {{- range .Values.imageAutomationController.container.additionalArgs }}
+        - {{ . }}
+        {{- end}}
+        env:
+        - name: RUNTIME_NAMESPACE
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.namespace
+        {{- with .Values.imageAutomationController.extraEnv }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
+        image: {{ template "template.image" .Values.imageAutomationController }}
+        {{- if .Values.imageAutomationController.imagePullPolicy }}
+        imagePullPolicy: {{ .Values.imageAutomationController.imagePullPolicy }}
+        {{- else }}
+        imagePullPolicy: IfNotPresent
+        {{- end }}
+        livenessProbe:
+          httpGet:
+            path: /healthz
+            port: healthz
+        name: manager
+        ports:
+        - containerPort: 8080
+          name: http-prom
+        - containerPort: 9440
+          name: healthz
+          protocol: TCP
+        readinessProbe:
+          httpGet:
+            path: /readyz
+            port: healthz
+        {{- with .Values.imageAutomationController.resources }}
+        resources: {{ toYaml . | nindent 10 }}
+        {{- end }}
+        {{- if .Values.imageAutomationController.securityContext }}
+        securityContext: {{ toYaml .Values.imageAutomationController.securityContext | nindent 10 }}
+        {{- else }}
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+          readOnlyRootFilesystem: true
+          runAsNonRoot: true
+          seccompProfile:
+            type: RuntimeDefault
+        {{- end}}
+        volumeMounts:
+        - mountPath: /tmp
+          name: temp
+        {{- if .Values.imageAutomationController.volumeMounts }}
+        {{- toYaml .Values.imageAutomationController.volumeMounts | nindent 8 }}
+        {{- end}}
+      {{- if .Values.imageAutomationController.priorityClassName }}
+      priorityClassName: {{ .Values.imageAutomationController.priorityClassName | quote }}
+      {{- end }}
+      {{- if .Values.imageAutomationController.podSecurityContext }}
+      securityContext: {{ toYaml .Values.imageAutomationController.podSecurityContext | nindent 8 }}
+      {{- else }}
+      securityContext:
+        fsGroup: 1337
+      {{- end}}
+      serviceAccountName: image-automation-controller
+      {{- if .Values.imagePullSecrets }}
+      imagePullSecrets: {{ toYaml .Values.imagePullSecrets | nindent 6 }}
+      {{- end }}
+      terminationGracePeriodSeconds: 10
+      volumes:
+      - emptyDir: {}
+        name: temp
+      {{- if .Values.imageAutomationController.volumes }}
+      {{- toYaml .Values.imageAutomationController.volumes | nindent 6 }}
+      {{- end}}
+      {{- with .Values.imageAutomationController.nodeSelector }}
+      nodeSelector: {{ toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.imageAutomationController.affinity }}
+      affinity: {{ toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.imageAutomationController.tolerations }}
+      tolerations: {{ toYaml . | nindent 8 }}
+      {{- end }}
+{{- end }}
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Andrei Kvapil	9efbf5d22e	Update release images	2024-05-06 13:51:30 +02:00
Andrei Kvapil	662f12e0ce	Fix kubernetes chart post-rendering	2024-05-06 13:42:11 +02:00
Andrei Kvapil	3439cf39dd	Add basic topologySpreadConstraints	2024-05-06 12:58:33 +02:00
Andrei Kvapil	965e1be283	Fix datastore creation depends on created secrets	2024-05-06 12:58:32 +02:00