diff --git a/.github/ISSUE_TEMPLATE/bug_report.md b/.github/ISSUE_TEMPLATE/bug_report.md
index fefdab82..1a119259 100644
--- a/.github/ISSUE_TEMPLATE/bug_report.md
+++ b/.github/ISSUE_TEMPLATE/bug_report.md
@@ -1,7 +1,7 @@
 ---
 name: Bug report
 about: Create a report to help us improve
-labels: 'kind/bug'
+labels: 'bug'
 assignees: ''
 
 ---
diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md
index 044dd6a0..b9475846 100644
--- a/.github/PULL_REQUEST_TEMPLATE.md
+++ b/.github/PULL_REQUEST_TEMPLATE.md
@@ -1,10 +1,9 @@
 <!-- Thank you for making a contribution! Here are some tips for you:
 - Use Conventional Commits for the PR title: `type(scope): description`
   - Types: feat, fix, docs, style, refactor, perf, test, build, ci, chore
-  - Scopes are not an exhaustive list — pick the most specific scope for the change and extend the list when a genuinely new area appears. Examples:
-    - System components: dashboard, platform, operator, cilium, kube-ovn, linstor, fluxcd, cluster-api
-    - Managed apps: postgres, mariadb, redis, kafka, clickhouse, virtual-machine, kubernetes
-    - Development and maintenance: api, hack, tests, ci, docs, maintenance
+  - Scopes for system components: dashboard, platform, cilium, kube-ovn, linstor, fluxcd, cluster-api
+  - Scopes for managed apps: postgres, mariadb, redis, kafka, clickhouse, virtual-machine, kubernetes
+  - Scopes for development and maintenance: api, hack, tests, ci, docs, maintenance
   - Breaking changes: append `!` after type/scope (`feat(api)!: ...`) or add a `BREAKING CHANGE:` footer
 - If it's a work in progress, consider creating this PR as a draft.
 - Don't hesistate to ask for opinion and review in the community chats, even if it's still a draft.
diff --git a/.github/labels.yml b/.github/labels.yml
deleted file mode 100644
index 2ce04130..00000000
--- a/.github/labels.yml
+++ /dev/null
@@ -1,371 +0,0 @@
-# Cozystack repository labels
-#
-# Label conventions follow the Kubernetes scheme:
-# https://github.com/kubernetes/test-infra/blob/master/label_sync/labels.md
-#
-# Synced into the repository by .github/workflows/labels.yaml
-# (EndBug/label-sync@v2). Edit this file via pull request — UI changes
-# will be overwritten on the next sync.
-#
-# Constraints (enforced by the validate job in labels.yaml):
-#   - description ≤ 100 characters (GitHub REST API limit)
-#   - color is a 6-character hex string (no leading #)
-#   - label names are unique
-#   - aliases do not collide with top-level names
-#
-# Categories:
-#   kind/         issue or PR type
-#   priority/     urgency
-#   triage/       review state
-#   lifecycle/    issue or PR lifecycle
-#   area/         subsystem; extensible — add when 3+ open issues exist
-#   do-not-merge/ PR merge blockers
-#   security/     security-finding severity and status (Cozystack-specific)
-#   size:         PR size (auto-applied)
-#
-# `aliases:` lets EndBug/label-sync rename existing labels without losing
-# references on already-tagged issues and PRs.
-#
-# GitHub-default labels not migrated here (`wontfix`, `invalid`) currently
-# carry zero issues/PRs in this repo and will be removed in a follow-up
-# cleanup PR rather than aliased to a different namespace.
-
-# ──────────────────────────────────────────────
-# kind/ — issue or PR type
-# ──────────────────────────────────────────────
-
-- name: kind/bug
-  color: 'd73a4a'
-  description: Categorizes issue or PR as related to a bug
-  aliases: ['bug']
-
-- name: kind/feature
-  color: 'a2eeef'
-  description: Categorizes issue or PR as related to a new feature
-  aliases: ['enhancement']
-
-- name: kind/documentation
-  color: '0075ca'
-  description: Categorizes issue or PR as related to documentation
-  aliases: ['documentation']
-
-- name: kind/support
-  color: 'd876e3'
-  description: Categorizes issue as a support question
-  aliases: ['question']
-
-- name: kind/cleanup
-  color: 'c7def8'
-  description: Categorizes issue or PR as related to cleanup of code, process, or technical debt
-
-- name: kind/regression
-  color: 'e11d21'
-  description: Categorizes issue or PR as related to a regression from a prior release
-
-- name: kind/flake
-  color: 'f7c6c7'
-  description: Categorizes issue or PR as related to a flaky test
-
-- name: kind/failing-test
-  color: 'e11d21'
-  description: Categorizes issue or PR as related to a consistently or frequently failing test
-
-- name: kind/api-change
-  color: 'c7def8'
-  description: Categorizes issue or PR as related to adding, removing, or otherwise changing an API
-
-- name: kind/breaking-change
-  color: 'e11d21'
-  description: Indicates the change introduces a breaking API or behaviour change
-
-# ──────────────────────────────────────────────
-# priority/ — urgency
-# ──────────────────────────────────────────────
-
-- name: priority/critical-urgent
-  color: 'e11d21'
-  description: Highest priority. Must be actively worked on as someone's top priority right now
-
-- name: priority/important-soon
-  color: 'eb6420'
-  description: Must be staffed and worked on either currently, or very soon, ideally in time for the next release
-
-- name: priority/important-longterm
-  color: 'fbca04'
-  description: Important over the long term, but may not be staffed and/or may need multiple releases to complete
-
-- name: priority/backlog
-  color: 'fef2c0'
-  description: General backlog priority. Lower than priority/important-longterm
-
-# ──────────────────────────────────────────────
-# triage/ — review state
-# ──────────────────────────────────────────────
-
-- name: triage/needs-triage
-  color: 'ededed'
-  description: Indicates an issue needs triage by a maintainer
-
-- name: triage/accepted
-  color: '0e8a16'
-  description: Indicates an issue is ready to be actively worked on
-
-- name: triage/needs-information
-  color: 'fbca04'
-  description: Indicates an issue needs more information in order to work on it
-
-- name: triage/not-reproducible
-  color: 'fbca04'
-  description: Indicates an issue can not be reproduced as described
-
-- name: triage/duplicate
-  color: 'cfd3d7'
-  description: Indicates an issue is a duplicate of another issue
-  aliases: ['duplicate']
-
-- name: triage/unresolved
-  color: 'cfd3d7'
-  description: Indicates an issue that can not or will not be resolved
-
-# ──────────────────────────────────────────────
-# lifecycle/ — issue or PR lifecycle
-# ──────────────────────────────────────────────
-
-- name: lifecycle/active
-  color: '1d76db'
-  description: Indicates that an issue or PR is actively being worked on by a contributor
-
-- name: lifecycle/frozen
-  color: 'db5dd6'
-  description: Indicates that an issue or PR should not be auto-closed due to staleness
-  aliases: ['frozen']
-
-- name: lifecycle/stale
-  color: 'dadada'
-  description: Denotes an issue or PR has remained open with no activity and has become stale
-  aliases: ['stale']
-
-- name: lifecycle/rotten
-  color: '795548'
-  description: Denotes an issue or PR that has aged beyond stale and will be auto-closed
-
-# ──────────────────────────────────────────────
-# area/ — subsystem (extensible)
-# Add a new area/* when there are 3+ open issues on the topic.
-# ──────────────────────────────────────────────
-
-- name: area/api
-  color: 'bfd4f2'
-  description: Issues or PRs related to the cozystack-api aggregated API server
-
-- name: area/ai
-  color: 'bfd4f2'
-  description: Issues or PRs related to AI agent guides, AGENTS.md, docs/agents/
-
-- name: area/build
-  color: 'bfd4f2'
-  description: Issues or PRs related to image build infrastructure, multi-arch support
-
-- name: area/ci
-  color: 'bfd4f2'
-  description: Issues or PRs related to CI workflows, GitHub Actions, automation
-
-- name: area/dashboard
-  color: 'bfd4f2'
-  description: Issues or PRs related to the dashboard / UI
-
-- name: area/extra
-  color: 'bfd4f2'
-  description: Issues or PRs related to tenant-specific modules (packages/extra/)
-
-- name: area/database
-  color: 'bfd4f2'
-  description: Issues or PRs related to managed databases (postgres, mariadb, redis, etcd, kafka, clickhouse)
-
-- name: area/kubernetes
-  color: 'bfd4f2'
-  description: Issues or PRs related to the tenant Kubernetes app
-
-- name: area/monitoring
-  color: 'bfd4f2'
-  description: Issues or PRs related to the monitoring stack (vlogs, vmstack, grafana, workloadmonitor)
-
-- name: area/networking
-  color: 'bfd4f2'
-  description: Issues or PRs related to networking (ingress, gateway, vpn, metallb, cilium, kube-ovn)
-
-- name: area/platform
-  color: 'bfd4f2'
-  description: Issues or PRs related to platform infrastructure (bundle, flux, talos, installer)
-
-- name: area/release
-  color: 'bfd4f2'
-  description: Issues or PRs related to release tooling (changelog, backport, release pipeline)
-
-- name: area/storage
-  color: 'bfd4f2'
-  description: Issues or PRs related to storage (linstor, seaweedfs, bucket, velero, harbor)
-
-- name: area/testing
-  color: 'bfd4f2'
-  description: Issues or PRs related to testing (e2e, bats, unit tests)
-
-- name: area/virtualization
-  color: 'bfd4f2'
-  description: Issues or PRs related to virtualization (kubevirt, cdi, vmi, vm-import)
-
-- name: area/uncategorized
-  color: 'fbca04'
-  description: PR auto-labeler could not map title scope to a known area/*; please review
-
-# ──────────────────────────────────────────────
-# do-not-merge/ — PR merge blockers (Prow convention)
-# ──────────────────────────────────────────────
-
-- name: do-not-merge/work-in-progress
-  color: 'e11d21'
-  description: Indicates that a PR should not merge because it is a work in progress
-  # Both legacy spellings collapse here. EndBug processes aliases sequentially;
-  # the second rename hits a name collision and logs a warning — the legacy
-  # label survives and gets cleaned up in the follow-up dedup PR.
-  aliases: ['do-not-merge', 'do not merge']
-
-- name: do-not-merge/hold
-  color: 'e11d21'
-  description: Indicates that a PR should not merge because someone has issued /hold
-
-# ──────────────────────────────────────────────
-# Cozystack-specific (preserved)
-# ──────────────────────────────────────────────
-
-- name: epic
-  color: 'a335ee'
-  description: A large development increment that brings definite value to Cozystack users
-
-- name: community
-  color: '97458a'
-  description: Community contributions are welcome in this issue
-
-- name: help wanted
-  color: '008672'
-  description: Extra attention is needed
-
-- name: good first issue
-  color: '7057ff'
-  description: Good for newcomers
-
-- name: quality-of-life
-  color: 'aaaaaa'
-  description: QoL improvements
-
-- name: upstream-issue
-  color: 'aaaaaa'
-  description: Requires resolving an issue in an upstream project
-
-- name: backport
-  color: 'fbca04'
-  description: Should change be backported on previous release
-
-- name: backport-previous
-  color: 'fbd876'
-  description: Backport target — previous release line
-
-- name: release
-  color: 'aaaaaa'
-  description: Releasing a new Cozystack version
-
-- name: automated
-  color: 'ededed'
-  description: Created by automation
-
-- name: debug
-  color: '704479'
-  description: Debugging in progress
-
-- name: sponsored
-  color: '00ff00'
-  description: Sponsored work
-
-- name: lgtm
-  color: '238636'
-  description: This PR has been approved by a maintainer
-
-- name: ok-to-test
-  color: '00ff00'
-  description: Indicates a non-member PR is safe to run CI on
-
-# ──────────────────────────────────────────────
-# size: — PR size (auto-applied by sizing bot)
-# ──────────────────────────────────────────────
-
-- name: 'size:XS'
-  color: '00ff00'
-  description: This PR changes 0-9 lines, ignoring generated files
-
-- name: 'size:S'
-  color: '77b800'
-  description: This PR changes 10-29 lines, ignoring generated files
-
-- name: 'size:M'
-  color: 'ebb800'
-  description: This PR changes 30-99 lines, ignoring generated files
-
-- name: 'size:L'
-  color: 'eb9500'
-  description: This PR changes 100-499 lines, ignoring generated files
-
-- name: 'size:XL'
-  color: 'ff823f'
-  description: This PR changes 500-999 lines, ignoring generated files
-
-- name: 'size:XXL'
-  color: 'ffb8b8'
-  description: This PR changes 1000+ lines, ignoring generated files
-
-# ──────────────────────────────────────────────
-# security/ — security-finding severity and status
-# ──────────────────────────────────────────────
-
-- name: security
-  color: 'aaaaaa'
-  description: Security-related issues and features
-
-- name: security/critical
-  color: 'd73a4a'
-  description: Critical security vulnerability
-
-- name: security/high
-  color: 'e99695'
-  description: High severity security finding
-
-- name: security/medium
-  color: 'f9c513'
-  description: Medium severity security finding
-
-- name: security/low
-  color: '0e8a16'
-  description: Low severity security finding
-
-- name: security/triage-needed
-  color: 'fbca04'
-  description: Needs security triage
-
-- name: security/confirmed
-  color: '1d76db'
-  description: Confirmed vulnerability
-
-- name: security/false-positive
-  color: 'c5def5'
-  description: Triaged as false positive
-
-- name: security/accepted-risk
-  color: 'bfd4f2'
-  description: Risk accepted with justification
-
-- name: security/in-progress
-  color: '0075ca'
-  description: Fix in progress
-
-- name: security/fixed
-  color: '0e8a16'
-  description: Fix released
diff --git a/.github/workflows/codegen-drift.yml b/.github/workflows/codegen-drift.yml
deleted file mode 100644
index a26caf5e..00000000
--- a/.github/workflows/codegen-drift.yml
+++ /dev/null
@@ -1,61 +0,0 @@
-name: Codegen Drift Check
-
-on:
-  pull_request:
-    types: [opened, synchronize, reopened]
-    paths:
-      - 'api/**'
-      - 'pkg/apis/**'
-      - 'pkg/generated/**'
-      - 'internal/crdinstall/manifests/**'
-      - 'packages/system/cozystack-controller/definitions/**'
-      - 'packages/system/application-definition-crd/definition/**'
-      - 'packages/system/backup-controller/definitions/**'
-      - 'packages/system/backupstrategy-controller/definitions/**'
-      - 'hack/update-codegen.sh'
-      - 'hack/boilerplate.go.txt'
-      - 'Makefile'
-      - 'go.mod'
-      - 'go.sum'
-      - '.github/workflows/codegen-drift.yml'
-
-concurrency:
-  group: codegen-drift-${{ github.workflow }}-${{ github.event.pull_request.number }}
-  cancel-in-progress: true
-
-jobs:
-  codegen-drift:
-    name: Verify generated code is up to date
-    runs-on: ubuntu-22.04
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-
-      - name: Set up Go
-        uses: actions/setup-go@v5
-        with:
-          go-version-file: go.mod
-          cache: true
-
-      - name: Pre-fetch k8s.io/code-generator module
-        # hack/update-codegen.sh sources kube_codegen.sh from the Go module cache.
-        # The module is not declared in go.mod, so fetch it explicitly at the
-        # version pinned in the script.
-        run: |
-          version=$(grep -oP 'code-generator@\Kv[0-9.]+' hack/update-codegen.sh)
-          tmpdir=$(mktemp -d)
-          cd "$tmpdir"
-          go mod init codegen-fetch
-          go get "k8s.io/code-generator@${version}"
-
-      - name: Run make generate
-        run: make generate
-
-      - name: Fail on drift
-        run: |
-          if [ -n "$(git status --porcelain)" ]; then
-            echo "::error::'make generate' produced changes. Run 'make generate' locally and commit the result."
-            git status --short
-            git diff --color=always
-            exit 1
-          fi
diff --git a/.github/workflows/labels.yaml b/.github/workflows/labels.yaml
deleted file mode 100644
index 69c18329..00000000
--- a/.github/workflows/labels.yaml
+++ /dev/null
@@ -1,84 +0,0 @@
-name: Labels
-
-on:
-  pull_request:
-    paths:
-      - .github/labels.yml
-      - .github/workflows/labels.yaml
-  push:
-    branches: [main]
-    paths:
-      - .github/labels.yml
-      - .github/workflows/labels.yaml
-  workflow_dispatch:
-  schedule:
-    - cron: '17 4 * * 1'  # Mondays at 04:17 UTC
-
-permissions:
-  contents: read
-
-concurrency:
-  group: labels-sync
-  cancel-in-progress: false
-
-jobs:
-  validate:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Validate labels.yml schema
-        run: |
-          python3 - <<'PY'
-          import re, sys, yaml
-
-          path = '.github/labels.yml'
-          data = yaml.safe_load(open(path))
-          errors = []
-
-          # 1. description ≤ 100 chars (GitHub REST API limit)
-          for label in data:
-              desc = label.get('description', '') or ''
-              if len(desc) > 100:
-                  errors.append(f"{label['name']}: description {len(desc)} chars (max 100)")
-
-          # 2. color is 6-char hex without leading #
-          for label in data:
-              color = label.get('color', '') or ''
-              if not re.match(r'^[0-9A-Fa-f]{6}$', color):
-                  errors.append(f"{label['name']}: bad color {color!r} (must be 6-char hex without #)")
-
-          # 3. unique top-level names
-          names = [label['name'] for label in data]
-          dups = sorted({n for n in names if names.count(n) > 1})
-          for n in dups:
-              errors.append(f"duplicate name: {n}")
-
-          # 4. aliases do not collide with any top-level name
-          name_set = set(names)
-          for label in data:
-              for alias in (label.get('aliases') or []):
-                  if alias in name_set:
-                      errors.append(f"alias {alias!r} (under {label['name']!r}) collides with a top-level name")
-
-          if errors:
-              for err in errors:
-                  print(f"::error::{err}")
-              sys.exit(1)
-
-          print(f"labels.yml schema OK ({len(data)} labels)")
-          PY
-
-  sync:
-    needs: validate
-    if: github.event_name != 'pull_request'
-    runs-on: ubuntu-latest
-    permissions:
-      issues: write
-      pull-requests: write
-    steps:
-      - uses: actions/checkout@v4
-      - uses: EndBug/label-sync@v2
-        with:
-          config-file: .github/labels.yml
-          delete-other-labels: false
diff --git a/.github/workflows/pr-labeler.yaml b/.github/workflows/pr-labeler.yaml
deleted file mode 100644
index 6e6f3017..00000000
--- a/.github/workflows/pr-labeler.yaml
+++ /dev/null
@@ -1,206 +0,0 @@
-name: PR Auto-Label
-
-on:
-  pull_request_target:
-    types: [opened, edited, reopened, synchronize]
-
-permissions:
-  contents: read
-  pull-requests: write
-
-jobs:
-  label:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Apply labels from PR title
-        uses: actions/github-script@v7
-        with:
-          script: |
-            // Conventional Commits types accepted by Cozystack (per docs/agents/contributing.md):
-            //   feat, fix, docs, style, refactor, perf, test, build, ci, chore, revert
-            // Mapping below maps a subset to kind/* — types not listed do not produce a kind/*.
-            const typeToKind = {
-              feat:     'kind/feature',
-              fix:      'kind/bug',
-              docs:     'kind/documentation',
-              chore:    'kind/cleanup',
-              refactor: 'kind/cleanup',
-              // style, perf, test, build, ci, revert — no kind mapping
-            };
-
-            // scope -> area/* mapping. Keys are the scopes observed in cozystack issues
-            // and PRs. Add new entries when a scope recurs (3+ times).
-            const scopeToArea = {
-              // area/api
-              'api':                 'area/api',
-              'cozystack-api':       'area/api',
-
-              // area/ai
-              'agents':              'area/ai',
-              'ai':                  'area/ai',
-
-              // area/build
-              'build':               'area/build',
-
-              // area/ci
-              'ci':                  'area/ci',
-
-              // area/dashboard
-              'dashboard':           'area/dashboard',
-
-              // area/database
-              'postgres':            'area/database',
-              'postgres-operator':   'area/database',
-              'mariadb':             'area/database',
-              'mariadb-operator':    'area/database',
-              'redis':               'area/database',
-              'etcd':                'area/database',
-              'kafka':               'area/database',
-              'clickhouse':          'area/database',
-
-              // area/extra
-              'extra':               'area/extra',
-
-              // area/kubernetes
-              'kubernetes':          'area/kubernetes',
-              'apps/kubernetes':     'area/kubernetes',
-
-              // area/monitoring
-              'monitoring':          'area/monitoring',
-              'vlogs':               'area/monitoring',
-              'vmstack':             'area/monitoring',
-              'grafana':             'area/monitoring',
-              'workloadmonitor':     'area/monitoring',
-
-              // area/networking
-              'ingress':             'area/networking',
-              'ingress-nginx':       'area/networking',
-              'gateway':             'area/networking',
-              'vpn':                 'area/networking',
-              'metallb':             'area/networking',
-              'cilium':              'area/networking',
-              'kube-ovn':            'area/networking',
-              'tcp-balancer':        'area/networking',
-              'securitygroups':      'area/networking',
-              'cozy-proxy':          'area/networking',
-
-              // area/platform
-              'platform':            'area/platform',
-              'bundle':              'area/platform',
-              'flux':                'area/platform',
-              'fluxcd':              'area/platform',
-              'cluster-api':         'area/platform',
-              'talos':               'area/platform',
-              'installer':           'area/platform',
-              'cozyctl':             'area/platform',
-              'cozystack-engine':    'area/platform',
-              'cozy-lib':            'area/platform',
-
-              // area/release
-              'backport':            'area/release',
-              'release':             'area/release',
-
-              // area/storage
-              'seaweedfs':           'area/storage',
-              'seaweedfs-cosi-driver': 'area/storage',
-              'bucket':              'area/storage',
-              'linstor':             'area/storage',
-              'velero':              'area/storage',
-              'harbor':              'area/storage',
-              'backups':             'area/storage',
-
-              // area/testing
-              'tests':               'area/testing',
-              'e2e':                 'area/testing',
-
-              // area/virtualization
-              'kubevirt':            'area/virtualization',
-              'cdi':                 'area/virtualization',
-              'vmi':                 'area/virtualization',
-              'vm-import':           'area/virtualization',
-              'virtual-machine':     'area/virtualization',
-              'hami':                'area/virtualization',
-              'gpu-operator':        'area/virtualization',
-            };
-
-            const pr = context.payload.pull_request;
-            const title = pr.title || '';
-            const body  = pr.body  || '';
-            const existing = new Set((pr.labels || []).map(l => l.name));
-            const toAdd = new Set();
-
-            // 1. Strip "[Backport release-1.x]" prefix if present.
-            const backportMatch = title.match(/^\[Backport ([^\]]+)\]\s+(.+)$/);
-            const cleanTitle = backportMatch ? backportMatch[2] : title;
-            if (backportMatch) {
-              toAdd.add('area/release');
-              toAdd.add('backport');
-            }
-
-            // 2. Try Conventional Commits form: type(scope)?(!)?: description
-            const conv = cleanTitle.match(/^([a-z]+)(?:\(([^)]+)\))?(!)?:\s*.+$/);
-            // 3. Fall back to bracket form: [scope] description
-            const bracket = !conv && cleanTitle.match(/^\[([^\]]+)\]\s+.+$/);
-
-            let type = null, scopeStr = null, breaking = false;
-            if (conv) {
-              type = conv[1];
-              scopeStr = conv[2] || null;
-              breaking = !!conv[3];
-            } else if (bracket) {
-              scopeStr = bracket[1];
-            }
-
-            // 4. Detect BREAKING CHANGE: or BREAKING-CHANGE: footer in body.
-            // Conventional Commits 1.0 spec item 16 treats them as synonymous.
-            if (/^BREAKING[ -]CHANGE:/m.test(body)) {
-              breaking = true;
-            }
-
-            // 5. Apply kind/* from type.
-            if (type) {
-              if (typeToKind[type]) {
-                toAdd.add(typeToKind[type]);
-              } else {
-                core.warning(`type "${type}" has no kind/* mapping — typo or new type? See .github/workflows/pr-labeler.yaml typeToKind`);
-              }
-            }
-
-            // 6. Apply area/* from scope. Composite scopes split on comma.
-            const scopes = (scopeStr || '')
-              .split(/,\s*/)
-              .map(s => s.trim())
-              .filter(Boolean);
-            for (const s of scopes) {
-              if (scopeToArea[s]) {
-                toAdd.add(scopeToArea[s]);
-              } else {
-                core.warning(`scope "${s}" has no area/* mapping — consider extending scopeToArea in .github/workflows/pr-labeler.yaml if it recurs`);
-              }
-            }
-
-            // 7. kind/breaking-change.
-            if (breaking) {
-              toAdd.add('kind/breaking-change');
-            }
-
-            // 8. Fallback: no area/* applied -> area/uncategorized.
-            const hasArea = [...toAdd].some(l => l.startsWith('area/'));
-            if (!hasArea) {
-              toAdd.add('area/uncategorized');
-            }
-
-            // 9. Additive only — never remove existing labels.
-            const newLabels = [...toAdd].filter(l => !existing.has(l));
-            if (newLabels.length === 0) {
-              core.info('No new labels to apply');
-              return;
-            }
-
-            await github.rest.issues.addLabels({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              issue_number: pr.number,
-              labels: newLabels,
-            });
-            core.info(`Applied labels: ${newLabels.join(', ')}`);
diff --git a/.github/workflows/tags.yaml b/.github/workflows/tags.yaml
index 1b68ee32..90f04829 100644
--- a/.github/workflows/tags.yaml
+++ b/.github/workflows/tags.yaml
@@ -223,7 +223,7 @@ jobs:
                 repo:  context.repo.repo,
                 head,
                 base,
-                title: `chore(release): cut v${version}`,
+                title: `Release v${version}`,
                 body:  `This PR prepares the release \`v${version}\`.`,
                 draft: false
               });
@@ -411,7 +411,7 @@ jobs:
                 repo:  context.repo.repo,
                 head:  changelogBranch,
                 base:  baseBranch,
-                title: `docs(release): add changelog for v${version}`,
+                title: `docs: add changelog for v${version}`,
                 body:  `This PR adds the changelog for release \`v${version}\`.\n\n✅ Changelog has been automatically generated in \`docs/changelogs/v${version}.md\`.`,
                 draft: false
               });
@@ -421,7 +421,7 @@ jobs:
                 owner: context.repo.owner,
                 repo:  context.repo.repo,
                 issue_number: pr.data.number,
-                labels: ['kind/documentation', 'automated']
+                labels: ['documentation', 'automated']
               });
               
               console.log(`Created PR #${pr.data.number} for changelog`);
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 6492b92d..ac0f7e30 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -1,17 +1,6 @@
 repos:
 - repo: local
   hooks:
-    - id: run-make-generate-root
-      name: Run 'make generate' at repo root
-      entry: |
-        flock -x .git/pre-commit.lock sh -c '
-          echo "Running make generate at repo root"
-          make generate || exit $?
-          git diff --color=always | cat
-        '
-      language: system
-      files: ^(api/|pkg/apis/|pkg/generated/|internal/crdinstall/manifests/|packages/system/cozystack-controller/definitions/|packages/system/application-definition-crd/definition/|packages/system/backup-controller/definitions/|packages/system/backupstrategy-controller/definitions/|hack/update-codegen\.sh$|hack/boilerplate\.go\.txt$|Makefile$)
-      pass_filenames: false
     - id: run-make-generate
       name: Run 'make generate' in all app directories
       entry: |
diff --git a/AGENTS.md b/AGENTS.md
index 1e9c4d15..fe9aa8e1 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -27,12 +27,6 @@ working with the **Cozystack** project.
   - Read: [`contributing.md`](./docs/agents/contributing.md)
   - Action: Read the file to understand git workflow, commit format, PR process
 
-- **Issue and PR labeling, triage** (e.g., "label this issue", "what label should I use", "triage this", "categorize")
-  - Read: [`.github/labels.yml`](./.github/labels.yml)
-  - Action: Use labels defined there. Conventions follow the Kubernetes scheme — `kind/*` (type), `area/*` (subsystem), `priority/*` (urgency), `triage/*` (review state), `lifecycle/*` (auto-close), `do-not-merge/*` (PR blockers), `security/*` (severity)
-  - For `area/*`: accuracy outweighs reuse. If no existing `area/*` truly fits the change, propose a new one via PR (extend `.github/labels.yml` and the scope mapping in `.github/workflows/pr-labeler.yaml`) — do not shoehorn the change into a wrong area. `area/uncategorized` is the auto-labeler fallback; treat it as a signal to pick a fit, create a new area, or correct the PR title
-  - PR titles: a Conventional Commits header (`type(scope): description`, types from [`contributing.md`](./docs/agents/contributing.md)) auto-applies `kind/*` and `area/*` via `.github/workflows/pr-labeler.yaml`. Append `!` (or add a `BREAKING CHANGE:` footer) to apply `kind/breaking-change`
-
 **Important rules:**
 - ✅ **ONLY read the file if the task matches the documented process scope** - do not read files for tasks that don't match their purpose
 - ✅ **ALWAYS read the file FIRST** before starting the task (when applicable)
diff --git a/Makefile b/Makefile
index acc9b6f6..0e94c5e6 100644
--- a/Makefile
+++ b/Makefile
@@ -22,7 +22,6 @@ build: build-deps
 	make -C packages/system/lineage-controller-webhook image
 	make -C packages/system/cilium image
 	make -C packages/system/linstor image
-	make -C packages/system/linstor-gui image
 	make -C packages/system/kubeovn-webhook image
 	make -C packages/system/kubeovn-plunger image
 	make -C packages/system/dashboard image
@@ -83,19 +82,11 @@ test:
 	make -C packages/core/testing apply
 	make -C packages/core/testing test
 
-unit-tests: helm-unit-tests bats-unit-tests go-unit-tests
+unit-tests: helm-unit-tests bats-unit-tests
 
 helm-unit-tests:
 	hack/helm-unit-tests.sh
 
-# Scoped go test over the cozystack-api surface that this repo owns. Kept
-# narrow intentionally - running `go test ./...` pulls in generated code
-# round-trip suites whose behavior depends on tool versions outside this
-# repo's control (kubebuilder, openapi-gen, etc.) and is better exercised
-# from their generator workflows.
-go-unit-tests:
-	go test ./pkg/registry/... ./pkg/config/... ./pkg/cmd/server/...
-
 # Discover every hack/*.bats file that is NOT an e2e test and run it
 # through cozytest.sh. Drop a new *.bats file in hack/ and it is picked
 # up automatically on the next `make unit-tests` run.
diff --git a/api/apps/v1alpha1/go.mod b/api/apps/v1alpha1/go.mod
index d5d57383..231ebbac 100644
--- a/api/apps/v1alpha1/go.mod
+++ b/api/apps/v1alpha1/go.mod
@@ -1,8 +1,8 @@
 module github.com/cozystack/cozystack/api/apps/v1alpha1
 
-go 1.25.0
+go 1.26.2
 
-require k8s.io/apimachinery v0.35.2
+require k8s.io/apimachinery v0.36.0
 
 require (
 	github.com/fxamacker/cbor/v2 v2.9.0 // indirect
@@ -12,13 +12,13 @@ require (
 	github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect
 	github.com/x448/float16 v0.8.4 // indirect
 	go.yaml.in/yaml/v2 v2.4.3 // indirect
-	golang.org/x/net v0.47.0 // indirect
-	golang.org/x/text v0.31.0 // indirect
+	golang.org/x/net v0.53.0 // indirect
+	golang.org/x/text v0.36.0 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
-	k8s.io/klog/v2 v2.130.1 // indirect
-	k8s.io/kube-openapi v0.0.0-20250910181357-589584f1c912 // indirect
-	k8s.io/utils v0.0.0-20251002143259-bc988d571ff4 // indirect
+	k8s.io/klog/v2 v2.140.0 // indirect
+	k8s.io/kube-openapi v0.0.0-20260317180543-43fb72c5454a // indirect
+	k8s.io/utils v0.0.0-20260210185600-b8788abfbbc2 // indirect
 	sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 // indirect
 	sigs.k8s.io/randfill v1.0.0 // indirect
-	sigs.k8s.io/structured-merge-diff/v6 v6.3.0 // indirect
+	sigs.k8s.io/structured-merge-diff/v6 v6.3.2 // indirect
 )
diff --git a/api/apps/v1alpha1/go.sum b/api/apps/v1alpha1/go.sum
index d9b1cf31..48970ca0 100644
--- a/api/apps/v1alpha1/go.sum
+++ b/api/apps/v1alpha1/go.sum
@@ -1,6 +1,7 @@
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
+github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/fxamacker/cbor/v2 v2.9.0 h1:NpKPmjDBgUfBms6tr6JZkTHtfFGcMKsw3eGcmD/sapM=
 github.com/fxamacker/cbor/v2 v2.9.0/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ=
 github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
@@ -16,8 +17,9 @@ github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJ
 github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
 github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee h1:W5t00kpgFdJifH4BDsTlE89Zl93FEloxaWZfGcifgq8=
 github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
-github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
+github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/spf13/pflag v1.0.9 h1:9exaQaMOCwffKiiiYk6/BndUBv+iRViNW+4lEMi0PvY=
 github.com/spf13/pflag v1.0.9/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
@@ -28,29 +30,29 @@ github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
 github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg=
 go.yaml.in/yaml/v2 v2.4.3 h1:6gvOSjQoTB3vt1l+CU+tSyi/HOjfOjRLJ4YwYZGwRO0=
 go.yaml.in/yaml/v2 v2.4.3/go.mod h1:zSxWcmIDjOzPXpjlTTbAsKokqkDNAVtZO0WOMiT90s8=
-golang.org/x/net v0.47.0 h1:Mx+4dIFzqraBXUugkia1OOvlD6LemFo1ALMHjrXDOhY=
-golang.org/x/net v0.47.0/go.mod h1:/jNxtkgq5yWUGYkaZGqo27cfGZ1c5Nen03aYrrKpVRU=
-golang.org/x/text v0.31.0 h1:aC8ghyu4JhP8VojJ2lEHBnochRno1sgL6nEi9WGFGMM=
-golang.org/x/text v0.31.0/go.mod h1:tKRAlv61yKIjGGHX/4tP1LTbc13YSec1pxVEWXzfoeM=
+golang.org/x/net v0.53.0 h1:d+qAbo5L0orcWAr0a9JweQpjXF19LMXJE8Ey7hwOdUA=
+golang.org/x/net v0.53.0/go.mod h1:JvMuJH7rrdiCfbeHoo3fCQU24Lf5JJwT9W3sJFulfgs=
+golang.org/x/text v0.36.0 h1:JfKh3XmcRPqZPKevfXVpI1wXPTqbkE5f7JA92a55Yxg=
+golang.org/x/text v0.36.0/go.mod h1:NIdBknypM8iqVmPiuco0Dh6P5Jcdk8lJL0CUebqK164=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/inf.v0 v0.9.1 h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc=
 gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-k8s.io/apimachinery v0.35.2 h1:NqsM/mmZA7sHW02JZ9RTtk3wInRgbVxL8MPfzSANAK8=
-k8s.io/apimachinery v0.35.2/go.mod h1:jQCgFZFR1F4Ik7hvr2g84RTJSZegBc8yHgFWKn//hns=
-k8s.io/klog/v2 v2.130.1 h1:n9Xl7H1Xvksem4KFG4PYbdQCQxqc/tTUyrgXaOhHSzk=
-k8s.io/klog/v2 v2.130.1/go.mod h1:3Jpz1GvMt720eyJH1ckRHK1EDfpxISzJ7I9OYgaDtPE=
-k8s.io/kube-openapi v0.0.0-20250910181357-589584f1c912 h1:Y3gxNAuB0OBLImH611+UDZcmKS3g6CthxToOb37KgwE=
-k8s.io/kube-openapi v0.0.0-20250910181357-589584f1c912/go.mod h1:kdmbQkyfwUagLfXIad1y2TdrjPFWp2Q89B3qkRwf/pQ=
-k8s.io/utils v0.0.0-20251002143259-bc988d571ff4 h1:SjGebBtkBqHFOli+05xYbK8YF1Dzkbzn+gDM4X9T4Ck=
-k8s.io/utils v0.0.0-20251002143259-bc988d571ff4/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
+k8s.io/apimachinery v0.36.0 h1:jZyPzhd5Z+3h9vJLt0z9XdzW9VzNzWAUw+P1xZ9PXtQ=
+k8s.io/apimachinery v0.36.0/go.mod h1:FklypaRJt6n5wUIwWXIP6GJlIpUizTgfo1T/As+Tyxc=
+k8s.io/klog/v2 v2.140.0 h1:Tf+J3AH7xnUzZyVVXhTgGhEKnFqye14aadWv7bzXdzc=
+k8s.io/klog/v2 v2.140.0/go.mod h1:o+/RWfJ6PwpnFn7OyAG3QnO47BFsymfEfrz6XyYSSp0=
+k8s.io/kube-openapi v0.0.0-20260317180543-43fb72c5454a h1:xCeOEAOoGYl2jnJoHkC3hkbPJgdATINPMAxaynU2Ovg=
+k8s.io/kube-openapi v0.0.0-20260317180543-43fb72c5454a/go.mod h1:uGBT7iTA6c6MvqUvSXIaYZo9ukscABYi2btjhvgKGZ0=
+k8s.io/utils v0.0.0-20260210185600-b8788abfbbc2 h1:AZYQSJemyQB5eRxqcPky+/7EdBj0xi3g0ZcxxJ7vbWU=
+k8s.io/utils v0.0.0-20260210185600-b8788abfbbc2/go.mod h1:xDxuJ0whA3d0I4mf/C4ppKHxXynQ+fxnkmQH0vTHnuk=
 sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 h1:IpInykpT6ceI+QxKBbEflcR5EXP7sU1kvOlxwZh5txg=
 sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730/go.mod h1:mdzfpAEoE6DHQEN0uh9ZbOCuHbLK5wOm7dK4ctXE9Tg=
 sigs.k8s.io/randfill v1.0.0 h1:JfjMILfT8A6RbawdsK2JXGBR5AQVfd+9TbzrlneTyrU=
 sigs.k8s.io/randfill v1.0.0/go.mod h1:XeLlZ/jmk4i1HRopwe7/aU3H5n1zNUcX6TM94b3QxOY=
-sigs.k8s.io/structured-merge-diff/v6 v6.3.0 h1:jTijUJbW353oVOd9oTlifJqOGEkUw2jB/fXCbTiQEco=
-sigs.k8s.io/structured-merge-diff/v6 v6.3.0/go.mod h1:M3W8sfWvn2HhQDIbGWj3S099YozAsymCo/wrT5ohRUE=
+sigs.k8s.io/structured-merge-diff/v6 v6.3.2 h1:kwVWMx5yS1CrnFWA/2QHyRVJ8jM6dBA80uLmm0wJkk8=
+sigs.k8s.io/structured-merge-diff/v6 v6.3.2/go.mod h1:M3W8sfWvn2HhQDIbGWj3S099YozAsymCo/wrT5ohRUE=
 sigs.k8s.io/yaml v1.6.0 h1:G8fkbMSAFqgEFgh4b1wmtzDnioxFCUgTZhlbj5P9QYs=
 sigs.k8s.io/yaml v1.6.0/go.mod h1:796bPqUfzR/0jLAl6XjHl3Ck7MiyVv8dbTdyT3/pMf4=
diff --git a/api/apps/v1alpha1/kubernetes/types.go b/api/apps/v1alpha1/kubernetes/types.go
index 88a3c97e..774fcdc5 100644
--- a/api/apps/v1alpha1/kubernetes/types.go
+++ b/api/apps/v1alpha1/kubernetes/types.go
@@ -36,9 +36,6 @@ type ConfigSpec struct {
 	// Kubernetes control-plane configuration.
 	// +kubebuilder:default:={}
 	ControlPlane ControlPlane `json:"controlPlane"`
-	// Optional image overrides for air-gapped or rate-limited registries.
-	// +kubebuilder:default:={}
-	Images Images `json:"images"`
 }
 
 type APIServer struct {
@@ -69,9 +66,6 @@ type Addons struct {
 	// NVIDIA GPU Operator.
 	// +kubebuilder:default:={}
 	GpuOperator GPUOperatorAddon `json:"gpuOperator"`
-	// HAMi GPU virtualization middleware.
-	// +kubebuilder:default:={}
-	Hami HAMiAddon `json:"hami"`
 	// Ingress-NGINX controller.
 	// +kubebuilder:default:={}
 	IngressNginx IngressNginxAddon `json:"ingressNginx"`
@@ -163,21 +157,6 @@ type GatewayAPIAddon struct {
 	Enabled bool `json:"enabled"`
 }
 
-type HAMiAddon struct {
-	// Enable HAMi (requires GPU Operator).
-	// +kubebuilder:default:=false
-	Enabled bool `json:"enabled"`
-	// Custom Helm values overrides.
-	// +kubebuilder:default:={}
-	ValuesOverride k8sRuntime.RawExtension `json:"valuesOverride"`
-}
-
-type Images struct {
-	// Image used by the wait-for-kubeconfig init container. Empty falls back to images/busybox.tag.
-	// +kubebuilder:default:=""
-	WaitForKubeconfig string `json:"waitForKubeconfig,omitempty"`
-}
-
 type IngressNginxAddon struct {
 	// Enable the controller (requires nodes labeled `ingress-nginx`).
 	// +kubebuilder:default:=false
diff --git a/api/apps/v1alpha1/kubernetes/zz_generated.deepcopy.go b/api/apps/v1alpha1/kubernetes/zz_generated.deepcopy.go
index e021fbaa..2cbe3ba1 100644
--- a/api/apps/v1alpha1/kubernetes/zz_generated.deepcopy.go
+++ b/api/apps/v1alpha1/kubernetes/zz_generated.deepcopy.go
@@ -49,7 +49,6 @@ func (in *Addons) DeepCopyInto(out *Addons) {
 	in.Fluxcd.DeepCopyInto(&out.Fluxcd)
 	out.GatewayAPI = in.GatewayAPI
 	in.GpuOperator.DeepCopyInto(&out.GpuOperator)
-	in.Hami.DeepCopyInto(&out.Hami)
 	in.IngressNginx.DeepCopyInto(&out.IngressNginx)
 	in.MonitoringAgents.DeepCopyInto(&out.MonitoringAgents)
 	in.Velero.DeepCopyInto(&out.Velero)
@@ -136,7 +135,6 @@ func (in *ConfigSpec) DeepCopyInto(out *ConfigSpec) {
 	}
 	in.Addons.DeepCopyInto(&out.Addons)
 	in.ControlPlane.DeepCopyInto(&out.ControlPlane)
-	out.Images = in.Images
 }
 
 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ConfigSpec.
@@ -262,37 +260,6 @@ func (in *GatewayAPIAddon) DeepCopy() *GatewayAPIAddon {
 	return out
 }
 
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *HAMiAddon) DeepCopyInto(out *HAMiAddon) {
-	*out = *in
-	in.ValuesOverride.DeepCopyInto(&out.ValuesOverride)
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new HAMiAddon.
-func (in *HAMiAddon) DeepCopy() *HAMiAddon {
-	if in == nil {
-		return nil
-	}
-	out := new(HAMiAddon)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *Images) DeepCopyInto(out *Images) {
-	*out = *in
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Images.
-func (in *Images) DeepCopy() *Images {
-	if in == nil {
-		return nil
-	}
-	out := new(Images)
-	in.DeepCopyInto(out)
-	return out
-}
-
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *IngressNginxAddon) DeepCopyInto(out *IngressNginxAddon) {
 	*out = *in
diff --git a/api/apps/v1alpha1/postgresql/types.go b/api/apps/v1alpha1/postgresql/types.go
index a2ff77a8..fa85d51f 100644
--- a/api/apps/v1alpha1/postgresql/types.go
+++ b/api/apps/v1alpha1/postgresql/types.go
@@ -92,9 +92,6 @@ type Bootstrap struct {
 	// Timestamp (RFC3339) for point-in-time recovery; empty means latest.
 	// +kubebuilder:default:=""
 	RecoveryTime string `json:"recoveryTime,omitempty"`
-	// Barman server name (S3 path prefix) used by the original cluster when writing backups. Set this only when the original cluster had an explicit barmanObjectStore.serverName that differed from its Kubernetes resource name.
-	// +kubebuilder:default:=""
-	ServerName string `json:"serverName,omitempty"`
 }
 
 type Database struct {
diff --git a/api/apps/v1alpha1/vminstance/types.go b/api/apps/v1alpha1/vminstance/types.go
index 9c48724a..2bb059c6 100644
--- a/api/apps/v1alpha1/vminstance/types.go
+++ b/api/apps/v1alpha1/vminstance/types.go
@@ -26,9 +26,6 @@ type ConfigSpec struct {
 	// Ports to forward from outside the cluster.
 	// +kubebuilder:default:={22}
 	ExternalPorts []int `json:"externalPorts,omitempty"`
-	// Whether to accept ICMP traffic to the VM in PortList mode (preserves ping and PMTU discovery). No effect in WholeIP mode. Default true so ping behaves as users expect even when port filtering is in effect.
-	// +kubebuilder:default:=true
-	ExternalAllowICMP bool `json:"externalAllowICMP"`
 	// Requested running state of the VirtualMachineInstance
 	// +kubebuilder:default:="Always"
 	RunStrategy RunStrategy `json:"runStrategy"`
diff --git a/api/backups/v1alpha1/zz_generated.deepcopy.go b/api/backups/v1alpha1/zz_generated.deepcopy.go
index 61b8f839..89f6171f 100644
--- a/api/backups/v1alpha1/zz_generated.deepcopy.go
+++ b/api/backups/v1alpha1/zz_generated.deepcopy.go
@@ -620,11 +620,6 @@ func (in *RestoreJobSpec) DeepCopyInto(out *RestoreJobSpec) {
 		*out = new(v1.TypedLocalObjectReference)
 		(*in).DeepCopyInto(*out)
 	}
-	if in.Options != nil {
-		in, out := &in.Options, &out.Options
-		*out = new(runtime.RawExtension)
-		(*in).DeepCopyInto(*out)
-	}
 }
 
 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RestoreJobSpec.
diff --git a/api/v1alpha1/packagesource_types.go b/api/v1alpha1/packagesource_types.go
index 75bf217b..c0b943e8 100644
--- a/api/v1alpha1/packagesource_types.go
+++ b/api/v1alpha1/packagesource_types.go
@@ -132,16 +132,6 @@ type ComponentInstall struct {
 	// DependsOn is a list of component names that must be installed before this component
 	// +optional
 	DependsOn []string `json:"dependsOn,omitempty"`
-
-	// UpgradeCRDs controls how CRDs from the chart's crds/ directory are
-	// handled on HelmRelease upgrades. Maps to HelmRelease.Spec.Upgrade.CRDs.
-	// Empty string (default) preserves the helm-controller default (Skip).
-	// Use "CreateReplace" for operators that evolve their CRD set between
-	// versions. Warning: CreateReplace overwrites CRDs and may cause data
-	// loss if upstream drops fields from a CRD with live objects.
-	// +optional
-	// +kubebuilder:validation:Enum=Skip;Create;CreateReplace
-	UpgradeCRDs string `json:"upgradeCRDs,omitempty"`
 }
 
 // Component defines a single Helm release component within a package source
diff --git a/dashboards/gpu/gpu-efficiency.json b/dashboards/gpu/gpu-efficiency.json
deleted file mode 100644
index 28a24568..00000000
--- a/dashboards/gpu/gpu-efficiency.json
+++ /dev/null
@@ -1,819 +0,0 @@
-{
-  "uid": "gpu-efficiency",
-  "title": "GPU Efficiency Score",
-  "description": "Tensor saturation, util/watt and throttling — reveals inefficient GPU workloads",
-  "tags": [
-    "gpu",
-    "efficiency",
-    "finops"
-  ],
-  "timezone": "browser",
-  "editable": true,
-  "graphTooltip": 1,
-  "time": {
-    "from": "now-1h",
-    "to": "now"
-  },
-  "fiscalYearStartMonth": 0,
-  "schemaVersion": 42,
-  "panels": [
-    {
-      "type": "row",
-      "collapsed": false,
-      "title": "Overall efficiency metrics",
-      "gridPos": {
-        "h": 1,
-        "w": 24,
-        "x": 0,
-        "y": 0
-      },
-      "id": 1,
-      "panels": []
-    },
-    {
-      "type": "stat",
-      "id": 2,
-      "targets": [
-        {
-          "expr": "avg(gpu:tensor_saturation:avg5m) * 100",
-          "refId": "A"
-        }
-      ],
-      "title": "Avg Tensor Saturation",
-      "description": "Mean tensor core saturation across all GPUs. \u003c10% means GPUs are used inefficiently (workloads could move to CPU or optimize their code). Cluster-wide — DCGM metrics cannot be attributed to workload namespaces.",
-      "transparent": false,
-      "datasource": {
-        "type": "prometheus",
-        "uid": "$ds_prometheus"
-      },
-      "gridPos": {
-        "h": 5,
-        "w": 8,
-        "x": 0,
-        "y": 1
-      },
-      "repeatDirection": "h",
-      "options": {
-        "graphMode": "area",
-        "colorMode": "background",
-        "justifyMode": "auto",
-        "textMode": "value",
-        "wideLayout": true,
-        "showPercentChange": false,
-        "reduceOptions": {
-          "calcs": [
-            "lastNotNull"
-          ]
-        },
-        "percentChangeColorMode": "standard",
-        "orientation": ""
-      },
-      "fieldConfig": {
-        "defaults": {
-          "unit": "percent",
-          "min": 0,
-          "max": 100,
-          "thresholds": {
-            "mode": "absolute",
-            "steps": [
-              {
-                "value": null,
-                "color": "red"
-              },
-              {
-                "value": 10,
-                "color": "orange"
-              },
-              {
-                "value": 30,
-                "color": "yellow"
-              },
-              {
-                "value": 60,
-                "color": "green"
-              }
-            ]
-          }
-        },
-        "overrides": []
-      }
-    },
-    {
-      "type": "stat",
-      "id": 3,
-      "targets": [
-        {
-          "expr": "avg(gpu:util_per_watt:avg5m)",
-          "refId": "A"
-        }
-      ],
-      "title": "Avg Utilization per Watt",
-      "description": "NVML utilization % per watt across all GPUs. Higher value = more efficient workload. Cluster-wide — DCGM metrics cannot be attributed to workload namespaces.",
-      "transparent": false,
-      "datasource": {
-        "type": "prometheus",
-        "uid": "$ds_prometheus"
-      },
-      "gridPos": {
-        "h": 5,
-        "w": 8,
-        "x": 8,
-        "y": 1
-      },
-      "repeatDirection": "h",
-      "options": {
-        "graphMode": "area",
-        "colorMode": "background",
-        "justifyMode": "auto",
-        "textMode": "value",
-        "wideLayout": true,
-        "showPercentChange": false,
-        "reduceOptions": {
-          "calcs": [
-            "lastNotNull"
-          ]
-        },
-        "percentChangeColorMode": "standard",
-        "orientation": ""
-      },
-      "fieldConfig": {
-        "defaults": {
-          "unit": "none",
-          "decimals": 3,
-          "thresholds": {
-            "mode": "absolute",
-            "steps": [
-              {
-                "value": null,
-                "color": "red"
-              },
-              {
-                "value": 0.5,
-                "color": "yellow"
-              },
-              {
-                "value": 1,
-                "color": "green"
-              }
-            ]
-          }
-        },
-        "overrides": []
-      }
-    },
-    {
-      "type": "stat",
-      "id": 4,
-      "targets": [
-        {
-          "expr": "avg(gpu:power_throttle_fraction:rate5m)",
-          "refId": "A"
-        }
-      ],
-      "title": "Avg Power Throttling",
-      "description": "Fraction of time GPUs hit the TDP cap and lose performance. \u003e5% means tenants underutilize billed FLOPS. Cluster-wide — rule aggregates by (Hostname, gpu, UUID) and drops namespace label.",
-      "transparent": false,
-      "datasource": {
-        "type": "prometheus",
-        "uid": "$ds_prometheus"
-      },
-      "gridPos": {
-        "h": 5,
-        "w": 8,
-        "x": 16,
-        "y": 1
-      },
-      "repeatDirection": "h",
-      "options": {
-        "graphMode": "area",
-        "colorMode": "background",
-        "justifyMode": "auto",
-        "textMode": "value",
-        "wideLayout": true,
-        "showPercentChange": false,
-        "reduceOptions": {
-          "calcs": [
-            "lastNotNull"
-          ]
-        },
-        "percentChangeColorMode": "standard",
-        "orientation": ""
-      },
-      "fieldConfig": {
-        "defaults": {
-          "unit": "percentunit",
-          "decimals": 2,
-          "thresholds": {
-            "mode": "absolute",
-            "steps": [
-              {
-                "value": null,
-                "color": "green"
-              },
-              {
-                "value": 0.05,
-                "color": "yellow"
-              },
-              {
-                "value": 0.2,
-                "color": "red"
-              }
-            ]
-          }
-        },
-        "overrides": []
-      }
-    },
-    {
-      "type": "row",
-      "collapsed": false,
-      "title": "NVML vs Tensor (mismatch detector)",
-      "gridPos": {
-        "h": 1,
-        "w": 24,
-        "x": 0,
-        "y": 6
-      },
-      "id": 10,
-      "panels": []
-    },
-    {
-      "type": "timeseries",
-      "id": 11,
-      "targets": [
-        {
-          "expr": "DCGM_FI_DEV_GPU_UTIL",
-          "legendFormat": "{{Hostname}}/{{gpu}}",
-          "refId": "A"
-        }
-      ],
-      "title": "NVML GPU Utilization",
-      "description": "Classic utilization metric. Shows activity of any engine (SM, copy, encoder). Cluster-wide — DCGM namespace is the exporter's own namespace, not the workload namespace.",
-      "transparent": false,
-      "datasource": {
-        "type": "prometheus",
-        "uid": "$ds_prometheus"
-      },
-      "gridPos": {
-        "h": 8,
-        "w": 12,
-        "x": 0,
-        "y": 7
-      },
-      "repeatDirection": "h",
-      "options": {
-        "legend": {
-          "displayMode": "table",
-          "placement": "bottom",
-          "showLegend": false,
-          "calcs": [
-            "mean",
-            "max"
-          ]
-        },
-        "tooltip": {
-          "mode": "multi",
-          "sort": ""
-        }
-      },
-      "fieldConfig": {
-        "defaults": {
-          "unit": "percent",
-          "min": 0,
-          "max": 100,
-          "custom": {
-            "drawStyle": "line",
-            "lineInterpolation": "linear",
-            "fillOpacity": 10,
-            "showPoints": "never"
-          }
-        },
-        "overrides": []
-      }
-    },
-    {
-      "type": "timeseries",
-      "id": 12,
-      "targets": [
-        {
-          "expr": "DCGM_FI_PROF_PIPE_TENSOR_ACTIVE * 100",
-          "legendFormat": "{{Hostname}}/{{gpu}}",
-          "refId": "A"
-        }
-      ],
-      "title": "Tensor Pipe Active",
-      "description": "Real tensor core load (HMMA). For AI/LLM inference it should be ≥20%, otherwise the workload is unoptimized. Cluster-wide — DCGM namespace is the exporter's own namespace, not the workload namespace.",
-      "transparent": false,
-      "datasource": {
-        "type": "prometheus",
-        "uid": "$ds_prometheus"
-      },
-      "gridPos": {
-        "h": 8,
-        "w": 12,
-        "x": 12,
-        "y": 7
-      },
-      "repeatDirection": "h",
-      "options": {
-        "legend": {
-          "displayMode": "table",
-          "placement": "bottom",
-          "showLegend": false,
-          "calcs": [
-            "mean",
-            "max"
-          ]
-        },
-        "tooltip": {
-          "mode": "multi",
-          "sort": ""
-        }
-      },
-      "fieldConfig": {
-        "defaults": {
-          "unit": "percent",
-          "min": 0,
-          "max": 100,
-          "custom": {
-            "drawStyle": "line",
-            "lineInterpolation": "linear",
-            "fillOpacity": 10,
-            "showPoints": "never"
-          }
-        },
-        "overrides": []
-      }
-    },
-    {
-      "type": "row",
-      "collapsed": false,
-      "title": "Per-GPU ranking",
-      "gridPos": {
-        "h": 1,
-        "w": 24,
-        "x": 0,
-        "y": 15
-      },
-      "id": 20,
-      "panels": []
-    },
-    {
-      "type": "table",
-      "id": 21,
-      "targets": [
-        {
-          "expr": "topk(20, gpu:tensor_saturation:avg5m * 100)",
-          "instant": true,
-          "range": false,
-          "format": "table",
-          "refId": "A"
-        }
-      ],
-      "title": "Tensor Saturation per GPU (5m avg)",
-      "description": "Which GPUs are exercising tensor cores and which are not. Sorted descending. Grouped by Hostname/gpu/UUID — DCGM metrics cannot be attributed to workload namespaces.",
-      "transparent": false,
-      "datasource": {
-        "type": "prometheus",
-        "uid": "$ds_prometheus"
-      },
-      "gridPos": {
-        "h": 8,
-        "w": 12,
-        "x": 0,
-        "y": 16
-      },
-      "repeatDirection": "h",
-      "transformations": [
-        {
-          "id": "organize",
-          "options": {
-            "excludeByName": {
-              "DCGM_FI_DRIVER_VERSION": true,
-              "Time": true,
-              "__name__": true,
-              "cluster": true,
-              "container": true,
-              "device": true,
-              "endpoint": true,
-              "gpu_driver_version": true,
-              "instance": true,
-              "job": true,
-              "modelName": true,
-              "namespace": true,
-              "pci_bus_id": true,
-              "pod": true,
-              "prometheus": true,
-              "service": true,
-              "tenant": true,
-              "tier": true,
-              "uid": true,
-              "unit": true
-            },
-            "indexByName": {
-              "Hostname": 0,
-              "UUID": 2,
-              "Value": 3,
-              "gpu": 1
-            },
-            "renameByName": {
-              "Hostname": "Node",
-              "UUID": "UUID",
-              "Value": "Saturation",
-              "gpu": "GPU"
-            }
-          }
-        }
-      ],
-      "options": {
-        "frameIndex": 0,
-        "showHeader": true,
-        "showTypeIcons": false,
-        "sortBy": [
-          {
-            "displayName": "Saturation",
-            "desc": true
-          }
-        ],
-        "footer": {
-          "show": false,
-          "reducer": []
-        },
-        "cellHeight": "sm"
-      },
-      "fieldConfig": {
-        "defaults": {},
-        "overrides": [
-          {
-            "matcher": {
-              "id": "byName",
-              "options": "Saturation"
-            },
-            "properties": [
-              {
-                "id": "unit",
-                "value": "percent"
-              },
-              {
-                "id": "min",
-                "value": 0
-              },
-              {
-                "id": "max",
-                "value": 100
-              },
-              {
-                "id": "custom.cellOptions",
-                "value": {
-                  "mode": "gradient",
-                  "type": "gauge"
-                }
-              },
-              {
-                "id": "thresholds",
-                "value": {
-                  "mode": "absolute",
-                  "steps": [
-                    {
-                      "color": "red"
-                    },
-                    {
-                      "color": "orange",
-                      "value": 10
-                    },
-                    {
-                      "color": "yellow",
-                      "value": 30
-                    },
-                    {
-                      "color": "green",
-                      "value": 60
-                    }
-                  ]
-                }
-              }
-            ]
-          }
-        ]
-      }
-    },
-    {
-      "type": "table",
-      "id": 22,
-      "targets": [
-        {
-          "expr": "topk(20, gpu:util_per_watt:avg5m)",
-          "instant": true,
-          "range": false,
-          "format": "table",
-          "refId": "A"
-        }
-      ],
-      "title": "Utilization / Watt per GPU (5m avg)",
-      "description": "How efficiently each GPU spends watts. Low value = poor optimization. Grouped by Hostname/gpu/UUID — DCGM metrics cannot be attributed to workload namespaces.",
-      "transparent": false,
-      "datasource": {
-        "type": "prometheus",
-        "uid": "$ds_prometheus"
-      },
-      "gridPos": {
-        "h": 8,
-        "w": 12,
-        "x": 12,
-        "y": 16
-      },
-      "repeatDirection": "h",
-      "transformations": [
-        {
-          "id": "organize",
-          "options": {
-            "excludeByName": {
-              "DCGM_FI_DRIVER_VERSION": true,
-              "Time": true,
-              "__name__": true,
-              "cluster": true,
-              "container": true,
-              "device": true,
-              "endpoint": true,
-              "gpu_driver_version": true,
-              "instance": true,
-              "job": true,
-              "modelName": true,
-              "namespace": true,
-              "pci_bus_id": true,
-              "pod": true,
-              "prometheus": true,
-              "service": true,
-              "tenant": true,
-              "tier": true,
-              "uid": true,
-              "unit": true
-            },
-            "indexByName": {
-              "Hostname": 0,
-              "UUID": 2,
-              "Value": 3,
-              "gpu": 1
-            },
-            "renameByName": {
-              "Hostname": "Node",
-              "UUID": "UUID",
-              "Value": "Util/Watt",
-              "gpu": "GPU"
-            }
-          }
-        }
-      ],
-      "options": {
-        "frameIndex": 0,
-        "showHeader": true,
-        "showTypeIcons": false,
-        "sortBy": [
-          {
-            "displayName": "Util/Watt",
-            "desc": true
-          }
-        ],
-        "footer": {
-          "show": false,
-          "reducer": []
-        },
-        "cellHeight": "sm"
-      },
-      "fieldConfig": {
-        "defaults": {},
-        "overrides": [
-          {
-            "matcher": {
-              "id": "byName",
-              "options": "Util/Watt"
-            },
-            "properties": [
-              {
-                "id": "unit",
-                "value": "none"
-              },
-              {
-                "id": "decimals",
-                "value": 3
-              },
-              {
-                "id": "min",
-                "value": 0
-              },
-              {
-                "id": "max",
-                "value": 1.5
-              },
-              {
-                "id": "custom.cellOptions",
-                "value": {
-                  "mode": "gradient",
-                  "type": "gauge"
-                }
-              },
-              {
-                "id": "thresholds",
-                "value": {
-                  "mode": "absolute",
-                  "steps": [
-                    {
-                      "color": "red"
-                    },
-                    {
-                      "color": "yellow",
-                      "value": 0.5
-                    },
-                    {
-                      "color": "green",
-                      "value": 1
-                    }
-                  ]
-                }
-              }
-            ]
-          }
-        ]
-      }
-    },
-    {
-      "type": "row",
-      "collapsed": false,
-      "title": "Throttling",
-      "gridPos": {
-        "h": 1,
-        "w": 24,
-        "x": 0,
-        "y": 24
-      },
-      "id": 30,
-      "panels": []
-    },
-    {
-      "type": "timeseries",
-      "id": 31,
-      "targets": [
-        {
-          "expr": "gpu:power_throttle_fraction:rate5m",
-          "legendFormat": "{{Hostname}}/{{gpu}}",
-          "refId": "A"
-        }
-      ],
-      "title": "Power throttle fraction per GPU",
-      "description": "Fraction of time the GPU was power-throttled. 1.0 = always throttled. Cluster-wide — rule aggregates by (Hostname, gpu, UUID) and drops namespace label.",
-      "transparent": false,
-      "datasource": {
-        "type": "prometheus",
-        "uid": "$ds_prometheus"
-      },
-      "gridPos": {
-        "h": 8,
-        "w": 12,
-        "x": 0,
-        "y": 25
-      },
-      "repeatDirection": "h",
-      "options": {
-        "legend": {
-          "displayMode": "table",
-          "placement": "bottom",
-          "showLegend": false,
-          "calcs": [
-            "mean",
-            "max"
-          ]
-        },
-        "tooltip": {
-          "mode": "multi",
-          "sort": ""
-        }
-      },
-      "fieldConfig": {
-        "defaults": {
-          "unit": "percentunit",
-          "min": 0,
-          "max": 1,
-          "thresholds": {
-            "mode": "absolute",
-            "steps": [
-              {
-                "value": null,
-                "color": "green"
-              },
-              {
-                "value": 0.05,
-                "color": "yellow"
-              },
-              {
-                "value": 0.2,
-                "color": "red"
-              }
-            ]
-          },
-          "custom": {
-            "drawStyle": "line",
-            "lineInterpolation": "linear",
-            "fillOpacity": 25,
-            "showPoints": "never"
-          }
-        },
-        "overrides": []
-      }
-    },
-    {
-      "type": "timeseries",
-      "id": 32,
-      "targets": [
-        {
-          "expr": "gpu:thermal_throttle_fraction:rate5m",
-          "legendFormat": "{{Hostname}}/{{gpu}}",
-          "refId": "A"
-        }
-      ],
-      "title": "Thermal throttle fraction per GPU",
-      "description": "Fraction of time the GPU was thermal-throttled. Cluster-wide — rule aggregates by (Hostname, gpu, UUID) and drops namespace label.",
-      "transparent": false,
-      "datasource": {
-        "type": "prometheus",
-        "uid": "$ds_prometheus"
-      },
-      "gridPos": {
-        "h": 8,
-        "w": 12,
-        "x": 12,
-        "y": 25
-      },
-      "repeatDirection": "h",
-      "options": {
-        "legend": {
-          "displayMode": "table",
-          "placement": "bottom",
-          "showLegend": false,
-          "calcs": [
-            "mean",
-            "max"
-          ]
-        },
-        "tooltip": {
-          "mode": "multi",
-          "sort": ""
-        }
-      },
-      "fieldConfig": {
-        "defaults": {
-          "unit": "percentunit",
-          "min": 0,
-          "max": 1,
-          "thresholds": {
-            "mode": "absolute",
-            "steps": [
-              {
-                "value": null,
-                "color": "green"
-              },
-              {
-                "value": 0.05,
-                "color": "yellow"
-              },
-              {
-                "value": 0.2,
-                "color": "red"
-              }
-            ]
-          },
-          "custom": {
-            "drawStyle": "line",
-            "lineInterpolation": "linear",
-            "fillOpacity": 25,
-            "showPoints": "never"
-          }
-        },
-        "overrides": []
-      }
-    }
-  ],
-  "templating": {
-    "list": [
-      {
-        "type": "datasource",
-        "name": "ds_prometheus",
-        "label": "Prometheus",
-        "skipUrlSync": false,
-        "query": "prometheus",
-        "current": {
-          "selected": false,
-          "text": "default",
-          "value": "default"
-        },
-        "multi": false,
-        "allowCustomValue": true,
-        "includeAll": false,
-        "regex": "",
-        "auto": false,
-        "auto_min": "10s",
-        "auto_count": 30
-      }
-    ]
-  },
-  "annotations": {}
-}
diff --git a/dashboards/gpu/gpu-fleet.json b/dashboards/gpu/gpu-fleet.json
deleted file mode 100644
index 60c12bfb..00000000
--- a/dashboards/gpu/gpu-fleet.json
+++ /dev/null
@@ -1,1157 +0,0 @@
-{
-  "uid": "gpu-fleet",
-  "title": "GPU Fleet Overview",
-  "description": "Cluster-wide GPU inventory, capacity, utilization and health — admin view across the whole fleet.",
-  "tags": [
-    "gpu",
-    "fleet",
-    "admin"
-  ],
-  "timezone": "browser",
-  "editable": true,
-  "graphTooltip": 1,
-  "time": {
-    "from": "now-6h",
-    "to": "now"
-  },
-  "fiscalYearStartMonth": 0,
-  "schemaVersion": 42,
-  "panels": [
-    {
-      "type": "row",
-      "collapsed": false,
-      "title": "Cluster snapshot",
-      "gridPos": {
-        "h": 1,
-        "w": 24,
-        "x": 0,
-        "y": 0
-      },
-      "id": 1,
-      "panels": []
-    },
-    {
-      "type": "stat",
-      "id": 2,
-      "targets": [
-        {
-          "expr": "cluster:gpu_count:total",
-          "refId": "A"
-        }
-      ],
-      "title": "Total GPUs",
-      "description": "Physical GPUs discovered by DCGM across all nodes.",
-      "transparent": false,
-      "datasource": {
-        "type": "prometheus",
-        "uid": "$ds_prometheus"
-      },
-      "gridPos": {
-        "h": 4,
-        "w": 4,
-        "x": 0,
-        "y": 1
-      },
-      "repeatDirection": "h",
-      "options": {
-        "graphMode": "none",
-        "colorMode": "value",
-        "justifyMode": "auto",
-        "textMode": "value",
-        "wideLayout": true,
-        "showPercentChange": false,
-        "reduceOptions": {
-          "calcs": [
-            "lastNotNull"
-          ]
-        },
-        "percentChangeColorMode": "standard",
-        "orientation": ""
-      },
-      "fieldConfig": {
-        "defaults": {
-          "unit": "short",
-          "thresholds": {
-            "mode": "absolute",
-            "steps": [
-              {
-                "value": null,
-                "color": "blue"
-              }
-            ]
-          }
-        },
-        "overrides": []
-      }
-    },
-    {
-      "type": "stat",
-      "id": 3,
-      "targets": [
-        {
-          "expr": "cluster:gpu_count:allocated",
-          "refId": "A"
-        }
-      ],
-      "title": "Allocated",
-      "description": "Sum of kube GPU requests across all pods. Billable view — includes Pending pods.",
-      "transparent": false,
-      "datasource": {
-        "type": "prometheus",
-        "uid": "$ds_prometheus"
-      },
-      "gridPos": {
-        "h": 4,
-        "w": 4,
-        "x": 4,
-        "y": 1
-      },
-      "repeatDirection": "h",
-      "options": {
-        "graphMode": "none",
-        "colorMode": "background",
-        "justifyMode": "auto",
-        "textMode": "value",
-        "wideLayout": true,
-        "showPercentChange": false,
-        "reduceOptions": {
-          "calcs": [
-            "lastNotNull"
-          ]
-        },
-        "percentChangeColorMode": "standard",
-        "orientation": ""
-      },
-      "fieldConfig": {
-        "defaults": {
-          "unit": "short",
-          "thresholds": {
-            "mode": "absolute",
-            "steps": [
-              {
-                "value": null,
-                "color": "blue"
-              },
-              {
-                "value": 1,
-                "color": "green"
-              }
-            ]
-          }
-        },
-        "overrides": []
-      }
-    },
-    {
-      "type": "stat",
-      "id": 4,
-      "targets": [
-        {
-          "expr": "cluster:gpu_count:free",
-          "refId": "A"
-        }
-      ],
-      "title": "Free",
-      "description": "Unallocated capacity available for new tenants.",
-      "transparent": false,
-      "datasource": {
-        "type": "prometheus",
-        "uid": "$ds_prometheus"
-      },
-      "gridPos": {
-        "h": 4,
-        "w": 4,
-        "x": 8,
-        "y": 1
-      },
-      "repeatDirection": "h",
-      "options": {
-        "graphMode": "none",
-        "colorMode": "background",
-        "justifyMode": "auto",
-        "textMode": "value",
-        "wideLayout": true,
-        "showPercentChange": false,
-        "reduceOptions": {
-          "calcs": [
-            "lastNotNull"
-          ]
-        },
-        "percentChangeColorMode": "standard",
-        "orientation": ""
-      },
-      "fieldConfig": {
-        "defaults": {
-          "unit": "short",
-          "thresholds": {
-            "mode": "absolute",
-            "steps": [
-              {
-                "value": null,
-                "color": "red"
-              },
-              {
-                "value": 1,
-                "color": "yellow"
-              },
-              {
-                "value": 2,
-                "color": "green"
-              }
-            ]
-          }
-        },
-        "overrides": []
-      }
-    },
-    {
-      "type": "stat",
-      "id": 5,
-      "targets": [
-        {
-          "expr": "count(count by (Hostname) (DCGM_FI_DEV_GPU_UTIL))",
-          "refId": "A"
-        }
-      ],
-      "title": "Nodes with GPU",
-      "description": "Nodes reporting at least one GPU to DCGM. Counted via DCGM_FI_DEV_GPU_UTIL because kube-state-metrics does not expose node labels by default.",
-      "transparent": false,
-      "datasource": {
-        "type": "prometheus",
-        "uid": "$ds_prometheus"
-      },
-      "gridPos": {
-        "h": 4,
-        "w": 4,
-        "x": 12,
-        "y": 1
-      },
-      "repeatDirection": "h",
-      "options": {
-        "graphMode": "none",
-        "colorMode": "value",
-        "justifyMode": "auto",
-        "textMode": "value",
-        "wideLayout": true,
-        "showPercentChange": false,
-        "reduceOptions": {
-          "calcs": [
-            "lastNotNull"
-          ]
-        },
-        "percentChangeColorMode": "standard",
-        "orientation": ""
-      },
-      "fieldConfig": {
-        "defaults": {
-          "unit": "short",
-          "thresholds": {
-            "mode": "absolute",
-            "steps": [
-              {
-                "value": null,
-                "color": "blue"
-              }
-            ]
-          }
-        },
-        "overrides": []
-      }
-    },
-    {
-      "type": "stat",
-      "id": 6,
-      "targets": [
-        {
-          "expr": "cluster:gpu_util:avg",
-          "refId": "A"
-        }
-      ],
-      "title": "Average utilization",
-      "description": "Legacy NVML utilization across all tenant GPUs.",
-      "transparent": false,
-      "datasource": {
-        "type": "prometheus",
-        "uid": "$ds_prometheus"
-      },
-      "gridPos": {
-        "h": 4,
-        "w": 4,
-        "x": 16,
-        "y": 1
-      },
-      "repeatDirection": "h",
-      "options": {
-        "graphMode": "area",
-        "colorMode": "value",
-        "justifyMode": "auto",
-        "textMode": "value",
-        "wideLayout": true,
-        "showPercentChange": false,
-        "reduceOptions": {
-          "calcs": [
-            "lastNotNull"
-          ]
-        },
-        "percentChangeColorMode": "standard",
-        "orientation": ""
-      },
-      "fieldConfig": {
-        "defaults": {
-          "unit": "percent",
-          "min": 0,
-          "max": 100,
-          "thresholds": {
-            "mode": "absolute",
-            "steps": [
-              {
-                "value": null,
-                "color": "blue"
-              },
-              {
-                "value": 30,
-                "color": "green"
-              },
-              {
-                "value": 80,
-                "color": "orange"
-              }
-            ]
-          }
-        },
-        "overrides": []
-      }
-    },
-    {
-      "type": "stat",
-      "id": 7,
-      "targets": [
-        {
-          "expr": "cluster:gpu_power_watts:sum",
-          "refId": "A"
-        }
-      ],
-      "title": "Total power",
-      "description": "Live power draw summed across the fleet.",
-      "transparent": false,
-      "datasource": {
-        "type": "prometheus",
-        "uid": "$ds_prometheus"
-      },
-      "gridPos": {
-        "h": 4,
-        "w": 4,
-        "x": 20,
-        "y": 1
-      },
-      "repeatDirection": "h",
-      "options": {
-        "graphMode": "area",
-        "colorMode": "value",
-        "justifyMode": "auto",
-        "textMode": "value",
-        "wideLayout": true,
-        "showPercentChange": false,
-        "reduceOptions": {
-          "calcs": [
-            "lastNotNull"
-          ]
-        },
-        "percentChangeColorMode": "standard",
-        "orientation": ""
-      },
-      "fieldConfig": {
-        "defaults": {
-          "unit": "watt",
-          "decimals": 0,
-          "thresholds": {
-            "mode": "absolute",
-            "steps": [
-              {
-                "value": null,
-                "color": "green"
-              }
-            ]
-          }
-        },
-        "overrides": []
-      }
-    },
-    {
-      "type": "row",
-      "collapsed": false,
-      "title": "Per-node GPU activity",
-      "gridPos": {
-        "h": 1,
-        "w": 24,
-        "x": 0,
-        "y": 5
-      },
-      "id": 10,
-      "panels": []
-    },
-    {
-      "type": "bargauge",
-      "id": 11,
-      "targets": [
-        {
-          "expr": "avg by (Hostname) (DCGM_FI_DEV_GPU_UTIL)",
-          "legendFormat": "{{Hostname}}",
-          "refId": "A"
-        }
-      ],
-      "title": "GPU utilization per node",
-      "description": "Average NVML utilization per node — spot idle or saturated hosts at a glance.",
-      "transparent": false,
-      "datasource": {
-        "type": "prometheus",
-        "uid": "$ds_prometheus"
-      },
-      "gridPos": {
-        "h": 8,
-        "w": 12,
-        "x": 0,
-        "y": 6
-      },
-      "repeatDirection": "h",
-      "options": {
-        "displayMode": "gradient",
-        "valueMode": "color",
-        "namePlacement": "auto",
-        "showUnfilled": true,
-        "sizing": "auto",
-        "minVizWidth": 8,
-        "minVizHeight": 16,
-        "legend": {
-          "displayMode": "list",
-          "placement": "bottom",
-          "showLegend": false,
-          "calcs": []
-        },
-        "reduceOptions": {
-          "calcs": [
-            "lastNotNull"
-          ]
-        },
-        "maxVizHeight": 300,
-        "orientation": "horizontal"
-      },
-      "fieldConfig": {
-        "defaults": {
-          "unit": "percent",
-          "min": 0,
-          "max": 100,
-          "thresholds": {
-            "mode": "absolute",
-            "steps": [
-              {
-                "value": null,
-                "color": "blue"
-              },
-              {
-                "value": 30,
-                "color": "green"
-              },
-              {
-                "value": 80,
-                "color": "orange"
-              }
-            ]
-          }
-        },
-        "overrides": []
-      }
-    },
-    {
-      "type": "bargauge",
-      "id": 12,
-      "targets": [
-        {
-          "expr": "sum by (Hostname) (DCGM_FI_DEV_POWER_USAGE) / clamp_min(sum by (Hostname) (DCGM_FI_DEV_POWER_MGMT_LIMIT), 1) * 100",
-          "legendFormat": "{{Hostname}}",
-          "refId": "A"
-        }
-      ],
-      "title": "Power draw per node (% of TDP)",
-      "description": "GPU power usage as a fraction of the node's combined TDP cap. Works across GPU SKUs without per-model thresholds. Requires DCGM_FI_DEV_POWER_MGMT_LIMIT from custom DCGM CSV (see packages/system/gpu-operator/examples/dcgm-custom-metrics.yaml).",
-      "transparent": false,
-      "datasource": {
-        "type": "prometheus",
-        "uid": "$ds_prometheus"
-      },
-      "gridPos": {
-        "h": 8,
-        "w": 12,
-        "x": 12,
-        "y": 6
-      },
-      "repeatDirection": "h",
-      "options": {
-        "displayMode": "gradient",
-        "valueMode": "color",
-        "namePlacement": "auto",
-        "showUnfilled": true,
-        "sizing": "auto",
-        "minVizWidth": 8,
-        "minVizHeight": 16,
-        "legend": {
-          "displayMode": "list",
-          "placement": "bottom",
-          "showLegend": false,
-          "calcs": []
-        },
-        "reduceOptions": {
-          "calcs": [
-            "lastNotNull"
-          ]
-        },
-        "maxVizHeight": 300,
-        "orientation": "horizontal"
-      },
-      "fieldConfig": {
-        "defaults": {
-          "unit": "percent",
-          "min": 0,
-          "max": 100,
-          "thresholds": {
-            "mode": "absolute",
-            "steps": [
-              {
-                "value": null,
-                "color": "green"
-              },
-              {
-                "value": 60,
-                "color": "yellow"
-              },
-              {
-                "value": 80,
-                "color": "orange"
-              }
-            ]
-          }
-        },
-        "overrides": []
-      }
-    },
-    {
-      "type": "row",
-      "collapsed": false,
-      "title": "Usage trends",
-      "gridPos": {
-        "h": 1,
-        "w": 24,
-        "x": 0,
-        "y": 14
-      },
-      "id": 20,
-      "panels": []
-    },
-    {
-      "type": "timeseries",
-      "id": 21,
-      "targets": [
-        {
-          "expr": "avg by (Hostname) (DCGM_FI_DEV_GPU_UTIL)",
-          "legendFormat": "{{Hostname}}",
-          "refId": "A"
-        }
-      ],
-      "title": "GPU utilization per node (trend)",
-      "description": "Per-node NVML utilization over time — shows shifting workload across hosts.",
-      "transparent": false,
-      "datasource": {
-        "type": "prometheus",
-        "uid": "$ds_prometheus"
-      },
-      "gridPos": {
-        "h": 8,
-        "w": 12,
-        "x": 0,
-        "y": 15
-      },
-      "repeatDirection": "h",
-      "options": {
-        "legend": {
-          "displayMode": "table",
-          "placement": "bottom",
-          "showLegend": false,
-          "calcs": [
-            "mean",
-            "max"
-          ]
-        },
-        "tooltip": {
-          "mode": "multi",
-          "sort": ""
-        }
-      },
-      "fieldConfig": {
-        "defaults": {
-          "unit": "percent",
-          "min": 0,
-          "max": 100,
-          "custom": {
-            "drawStyle": "line",
-            "lineInterpolation": "linear",
-            "fillOpacity": 20,
-            "showPoints": "never"
-          }
-        },
-        "overrides": []
-      }
-    },
-    {
-      "type": "timeseries",
-      "id": 22,
-      "targets": [
-        {
-          "expr": "sum by (Hostname) (DCGM_FI_DEV_POWER_USAGE)",
-          "legendFormat": "{{Hostname}}",
-          "refId": "A"
-        }
-      ],
-      "title": "Power draw per node (trend)",
-      "description": "Per-node GPU power consumption over time.",
-      "transparent": false,
-      "datasource": {
-        "type": "prometheus",
-        "uid": "$ds_prometheus"
-      },
-      "gridPos": {
-        "h": 8,
-        "w": 12,
-        "x": 12,
-        "y": 15
-      },
-      "repeatDirection": "h",
-      "options": {
-        "legend": {
-          "displayMode": "table",
-          "placement": "bottom",
-          "showLegend": false,
-          "calcs": [
-            "mean",
-            "max"
-          ]
-        },
-        "tooltip": {
-          "mode": "multi",
-          "sort": ""
-        }
-      },
-      "fieldConfig": {
-        "defaults": {
-          "unit": "watt",
-          "custom": {
-            "drawStyle": "line",
-            "lineInterpolation": "linear",
-            "fillOpacity": 20,
-            "showPoints": "never"
-          }
-        },
-        "overrides": []
-      }
-    },
-    {
-      "type": "row",
-      "collapsed": false,
-      "title": "Health",
-      "gridPos": {
-        "h": 1,
-        "w": 24,
-        "x": 0,
-        "y": 23
-      },
-      "id": 30,
-      "panels": []
-    },
-    {
-      "type": "stat",
-      "id": 31,
-      "targets": [
-        {
-          "expr": "count((max by (Hostname, gpu) (DCGM_FI_DEV_XID_ERRORS)) \u003e 0) or vector(0)",
-          "refId": "A"
-        }
-      ],
-      "title": "GPUs with XID errors",
-      "description": "Count of GPUs reporting a non-zero XID code. XID = NVIDIA hardware/driver error — any non-zero value needs investigation.",
-      "transparent": false,
-      "datasource": {
-        "type": "prometheus",
-        "uid": "$ds_prometheus"
-      },
-      "gridPos": {
-        "h": 5,
-        "w": 6,
-        "x": 0,
-        "y": 24
-      },
-      "repeatDirection": "h",
-      "options": {
-        "graphMode": "none",
-        "colorMode": "background",
-        "justifyMode": "auto",
-        "textMode": "value",
-        "wideLayout": true,
-        "showPercentChange": false,
-        "reduceOptions": {
-          "calcs": [
-            "lastNotNull"
-          ]
-        },
-        "percentChangeColorMode": "standard",
-        "orientation": ""
-      },
-      "fieldConfig": {
-        "defaults": {
-          "unit": "short",
-          "thresholds": {
-            "mode": "absolute",
-            "steps": [
-              {
-                "value": null,
-                "color": "green"
-              },
-              {
-                "value": 1,
-                "color": "red"
-              }
-            ]
-          }
-        },
-        "overrides": []
-      }
-    },
-    {
-      "type": "stat",
-      "id": 32,
-      "targets": [
-        {
-          "expr": "avg(gpu:power_throttle_fraction:rate5m)",
-          "refId": "A"
-        }
-      ],
-      "title": "Power throttling (cluster avg)",
-      "description": "Fraction of time the fleet spent power-throttled. \u003e5% = billed FLOPS are being underdelivered.",
-      "transparent": false,
-      "datasource": {
-        "type": "prometheus",
-        "uid": "$ds_prometheus"
-      },
-      "gridPos": {
-        "h": 5,
-        "w": 6,
-        "x": 6,
-        "y": 24
-      },
-      "repeatDirection": "h",
-      "options": {
-        "graphMode": "none",
-        "colorMode": "background",
-        "justifyMode": "auto",
-        "textMode": "value",
-        "wideLayout": true,
-        "showPercentChange": false,
-        "reduceOptions": {
-          "calcs": [
-            "lastNotNull"
-          ]
-        },
-        "percentChangeColorMode": "standard",
-        "orientation": ""
-      },
-      "fieldConfig": {
-        "defaults": {
-          "unit": "percentunit",
-          "decimals": 2,
-          "thresholds": {
-            "mode": "absolute",
-            "steps": [
-              {
-                "value": null,
-                "color": "green"
-              },
-              {
-                "value": 0.05,
-                "color": "yellow"
-              },
-              {
-                "value": 0.2,
-                "color": "red"
-              }
-            ]
-          }
-        },
-        "overrides": []
-      }
-    },
-    {
-      "type": "stat",
-      "id": 33,
-      "targets": [
-        {
-          "expr": "avg(gpu:thermal_throttle_fraction:rate5m)",
-          "refId": "A"
-        }
-      ],
-      "title": "Thermal throttling (cluster avg)",
-      "description": "Fraction of time the fleet spent thermal-throttled. Indicates cooling/datacenter issues.",
-      "transparent": false,
-      "datasource": {
-        "type": "prometheus",
-        "uid": "$ds_prometheus"
-      },
-      "gridPos": {
-        "h": 5,
-        "w": 6,
-        "x": 12,
-        "y": 24
-      },
-      "repeatDirection": "h",
-      "options": {
-        "graphMode": "none",
-        "colorMode": "background",
-        "justifyMode": "auto",
-        "textMode": "value",
-        "wideLayout": true,
-        "showPercentChange": false,
-        "reduceOptions": {
-          "calcs": [
-            "lastNotNull"
-          ]
-        },
-        "percentChangeColorMode": "standard",
-        "orientation": ""
-      },
-      "fieldConfig": {
-        "defaults": {
-          "unit": "percentunit",
-          "decimals": 2,
-          "thresholds": {
-            "mode": "absolute",
-            "steps": [
-              {
-                "value": null,
-                "color": "green"
-              },
-              {
-                "value": 0.05,
-                "color": "yellow"
-              },
-              {
-                "value": 0.2,
-                "color": "red"
-              }
-            ]
-          }
-        },
-        "overrides": []
-      }
-    },
-    {
-      "type": "stat",
-      "id": 34,
-      "targets": [
-        {
-          "expr": "max(DCGM_FI_DEV_GPU_TEMP)",
-          "refId": "A"
-        }
-      ],
-      "title": "Max GPU temperature",
-      "description": "Hottest GPU in the fleet right now. Adjust thresholds to match your GPU model specifications.",
-      "transparent": false,
-      "datasource": {
-        "type": "prometheus",
-        "uid": "$ds_prometheus"
-      },
-      "gridPos": {
-        "h": 5,
-        "w": 6,
-        "x": 18,
-        "y": 24
-      },
-      "repeatDirection": "h",
-      "options": {
-        "graphMode": "none",
-        "colorMode": "background",
-        "justifyMode": "auto",
-        "textMode": "value",
-        "wideLayout": true,
-        "showPercentChange": false,
-        "reduceOptions": {
-          "calcs": [
-            "lastNotNull"
-          ]
-        },
-        "percentChangeColorMode": "standard",
-        "orientation": ""
-      },
-      "fieldConfig": {
-        "defaults": {
-          "unit": "celsius",
-          "thresholds": {
-            "mode": "absolute",
-            "steps": [
-              {
-                "value": null,
-                "color": "green"
-              },
-              {
-                "value": 75,
-                "color": "yellow"
-              },
-              {
-                "value": 85,
-                "color": "red"
-              }
-            ]
-          }
-        },
-        "overrides": []
-      }
-    },
-    {
-      "type": "timeseries",
-      "id": 35,
-      "targets": [
-        {
-          "expr": "DCGM_FI_DEV_GPU_TEMP",
-          "legendFormat": "{{Hostname}}/{{gpu}}",
-          "refId": "A"
-        }
-      ],
-      "title": "Temperature per GPU",
-      "description": "Per-GPU temperature trace. Sustained red zone = cooling issue or aggressive workload.",
-      "transparent": false,
-      "datasource": {
-        "type": "prometheus",
-        "uid": "$ds_prometheus"
-      },
-      "gridPos": {
-        "h": 8,
-        "w": 12,
-        "x": 0,
-        "y": 29
-      },
-      "repeatDirection": "h",
-      "options": {
-        "legend": {
-          "displayMode": "table",
-          "placement": "bottom",
-          "showLegend": false,
-          "calcs": [
-            "mean",
-            "max"
-          ]
-        },
-        "tooltip": {
-          "mode": "multi",
-          "sort": ""
-        }
-      },
-      "fieldConfig": {
-        "defaults": {
-          "unit": "celsius",
-          "min": 20,
-          "max": 100,
-          "thresholds": {
-            "mode": "absolute",
-            "steps": [
-              {
-                "value": null,
-                "color": "green"
-              },
-              {
-                "value": 75,
-                "color": "yellow"
-              },
-              {
-                "value": 85,
-                "color": "red"
-              }
-            ]
-          },
-          "custom": {
-            "drawStyle": "line",
-            "lineInterpolation": "linear",
-            "fillOpacity": 10,
-            "showPoints": "never"
-          }
-        },
-        "overrides": []
-      }
-    },
-    {
-      "type": "timeseries",
-      "id": 36,
-      "targets": [
-        {
-          "expr": "gpu:power_throttle_fraction:rate5m",
-          "legendFormat": "power {{Hostname}}/{{gpu}}",
-          "refId": "A"
-        },
-        {
-          "expr": "gpu:thermal_throttle_fraction:rate5m",
-          "legendFormat": "thermal {{Hostname}}/{{gpu}}",
-          "refId": "B"
-        }
-      ],
-      "title": "Throttle fraction per GPU",
-      "description": "Red = power throttle, blue = thermal throttle. Both on same chart to compare causes.",
-      "transparent": false,
-      "datasource": {
-        "type": "prometheus",
-        "uid": "$ds_prometheus"
-      },
-      "gridPos": {
-        "h": 8,
-        "w": 12,
-        "x": 12,
-        "y": 29
-      },
-      "repeatDirection": "h",
-      "options": {
-        "legend": {
-          "displayMode": "table",
-          "placement": "bottom",
-          "showLegend": false,
-          "calcs": [
-            "mean",
-            "max"
-          ]
-        },
-        "tooltip": {
-          "mode": "multi",
-          "sort": ""
-        }
-      },
-      "fieldConfig": {
-        "defaults": {
-          "unit": "percentunit",
-          "min": 0,
-          "max": 1,
-          "custom": {
-            "drawStyle": "line",
-            "lineInterpolation": "linear",
-            "fillOpacity": 25,
-            "showPoints": "never"
-          }
-        },
-        "overrides": []
-      }
-    },
-    {
-      "type": "row",
-      "collapsed": false,
-      "title": "Hardware inventory",
-      "gridPos": {
-        "h": 1,
-        "w": 24,
-        "x": 0,
-        "y": 37
-      },
-      "id": 40,
-      "panels": []
-    },
-    {
-      "type": "table",
-      "id": 41,
-      "targets": [
-        {
-          "expr": "group by (Hostname, modelName, gpu, UUID) (DCGM_FI_DEV_GPU_UTIL)",
-          "instant": true,
-          "range": false,
-          "format": "table",
-          "refId": "A"
-        }
-      ],
-      "title": "GPU inventory",
-      "description": "One row per physical GPU. Model / index / UUID sourced from DCGM labels.",
-      "transparent": false,
-      "datasource": {
-        "type": "prometheus",
-        "uid": "$ds_prometheus"
-      },
-      "gridPos": {
-        "h": 6,
-        "w": 24,
-        "x": 0,
-        "y": 38
-      },
-      "repeatDirection": "h",
-      "transformations": [
-        {
-          "id": "organize",
-          "options": {
-            "excludeByName": {
-              "Time": true,
-              "Value": true,
-              "__name__": true,
-              "cluster": true,
-              "container": true,
-              "device": true,
-              "endpoint": true,
-              "instance": true,
-              "job": true,
-              "pci_bus_id": true,
-              "prometheus": true,
-              "service": true,
-              "tenant": true,
-              "tier": true,
-              "uid": true,
-              "unit": true
-            },
-            "indexByName": {
-              "Hostname": 0,
-              "UUID": 3,
-              "gpu": 2,
-              "modelName": 1
-            },
-            "renameByName": {
-              "Hostname": "Node",
-              "UUID": "UUID",
-              "gpu": "Index",
-              "modelName": "GPU Model"
-            }
-          }
-        }
-      ],
-      "options": {
-        "frameIndex": 0,
-        "showHeader": true,
-        "showTypeIcons": false,
-        "footer": {
-          "show": false,
-          "reducer": []
-        },
-        "cellHeight": "sm"
-      }
-    }
-  ],
-  "templating": {
-    "list": [
-      {
-        "type": "datasource",
-        "name": "ds_prometheus",
-        "label": "Prometheus",
-        "skipUrlSync": false,
-        "query": "prometheus",
-        "current": {
-          "selected": false,
-          "text": "default",
-          "value": "default"
-        },
-        "multi": false,
-        "allowCustomValue": true,
-        "includeAll": false,
-        "regex": "",
-        "auto": false,
-        "auto_min": "10s",
-        "auto_count": 30
-      }
-    ]
-  },
-  "annotations": {}
-}
diff --git a/dashboards/gpu/gpu-performance.json b/dashboards/gpu/gpu-performance.json
deleted file mode 100644
index aed9c69a..00000000
--- a/dashboards/gpu/gpu-performance.json
+++ /dev/null
@@ -1,957 +0,0 @@
-{
-  "uid": "gpu-performance",
-  "title": "GPU Performance",
-  "tags": [
-    "gpu",
-    "dcgm"
-  ],
-  "timezone": "browser",
-  "editable": true,
-  "graphTooltip": 1,
-  "time": {
-    "from": "now-1h",
-    "to": "now"
-  },
-  "fiscalYearStartMonth": 0,
-  "schemaVersion": 42,
-  "panels": [
-    {
-      "type": "row",
-      "collapsed": false,
-      "title": "Overview",
-      "gridPos": {
-        "h": 1,
-        "w": 24,
-        "x": 0,
-        "y": 0
-      },
-      "id": 1,
-      "panels": []
-    },
-    {
-      "type": "stat",
-      "id": 2,
-      "targets": [
-        {
-          "expr": "cluster:gpu_count:total",
-          "refId": "A"
-        }
-      ],
-      "title": "Total GPUs",
-      "transparent": false,
-      "datasource": {
-        "type": "prometheus",
-        "uid": "$ds_prometheus"
-      },
-      "gridPos": {
-        "h": 4,
-        "w": 6,
-        "x": 0,
-        "y": 1
-      },
-      "repeatDirection": "h",
-      "options": {
-        "graphMode": "none",
-        "colorMode": "value",
-        "justifyMode": "auto",
-        "textMode": "value",
-        "wideLayout": true,
-        "showPercentChange": false,
-        "reduceOptions": {
-          "calcs": [
-            "lastNotNull"
-          ]
-        },
-        "percentChangeColorMode": "standard",
-        "orientation": ""
-      },
-      "fieldConfig": {
-        "defaults": {
-          "unit": "short",
-          "thresholds": {
-            "mode": "absolute",
-            "steps": [
-              {
-                "value": null,
-                "color": "blue"
-              }
-            ]
-          }
-        },
-        "overrides": []
-      }
-    },
-    {
-      "type": "stat",
-      "id": 3,
-      "targets": [
-        {
-          "expr": "cluster:gpu_count:allocated",
-          "refId": "A"
-        }
-      ],
-      "title": "Allocated",
-      "transparent": false,
-      "datasource": {
-        "type": "prometheus",
-        "uid": "$ds_prometheus"
-      },
-      "gridPos": {
-        "h": 4,
-        "w": 6,
-        "x": 6,
-        "y": 1
-      },
-      "repeatDirection": "h",
-      "options": {
-        "graphMode": "none",
-        "colorMode": "value",
-        "justifyMode": "auto",
-        "textMode": "value",
-        "wideLayout": true,
-        "showPercentChange": false,
-        "reduceOptions": {
-          "calcs": [
-            "lastNotNull"
-          ]
-        },
-        "percentChangeColorMode": "standard",
-        "orientation": ""
-      },
-      "fieldConfig": {
-        "defaults": {
-          "unit": "short",
-          "thresholds": {
-            "mode": "absolute",
-            "steps": [
-              {
-                "value": null,
-                "color": "green"
-              },
-              {
-                "value": 1,
-                "color": "yellow"
-              }
-            ]
-          }
-        },
-        "overrides": []
-      }
-    },
-    {
-      "type": "stat",
-      "id": 4,
-      "targets": [
-        {
-          "expr": "cluster:gpu_util:avg",
-          "refId": "A"
-        }
-      ],
-      "title": "Average utilization",
-      "transparent": false,
-      "datasource": {
-        "type": "prometheus",
-        "uid": "$ds_prometheus"
-      },
-      "gridPos": {
-        "h": 4,
-        "w": 6,
-        "x": 12,
-        "y": 1
-      },
-      "repeatDirection": "h",
-      "options": {
-        "graphMode": "area",
-        "colorMode": "value",
-        "justifyMode": "auto",
-        "textMode": "value",
-        "wideLayout": true,
-        "showPercentChange": false,
-        "reduceOptions": {
-          "calcs": [
-            "lastNotNull"
-          ]
-        },
-        "percentChangeColorMode": "standard",
-        "orientation": ""
-      },
-      "fieldConfig": {
-        "defaults": {
-          "unit": "percent",
-          "min": 0,
-          "max": 100,
-          "thresholds": {
-            "mode": "absolute",
-            "steps": [
-              {
-                "value": null,
-                "color": "blue"
-              },
-              {
-                "value": 30,
-                "color": "green"
-              },
-              {
-                "value": 80,
-                "color": "orange"
-              }
-            ]
-          }
-        },
-        "overrides": []
-      }
-    },
-    {
-      "type": "stat",
-      "id": 5,
-      "targets": [
-        {
-          "expr": "cluster:gpu_power_watts:sum",
-          "refId": "A"
-        }
-      ],
-      "title": "Power draw",
-      "transparent": false,
-      "datasource": {
-        "type": "prometheus",
-        "uid": "$ds_prometheus"
-      },
-      "gridPos": {
-        "h": 4,
-        "w": 6,
-        "x": 18,
-        "y": 1
-      },
-      "repeatDirection": "h",
-      "options": {
-        "graphMode": "area",
-        "colorMode": "value",
-        "justifyMode": "auto",
-        "textMode": "value",
-        "wideLayout": true,
-        "showPercentChange": false,
-        "reduceOptions": {
-          "calcs": [
-            "lastNotNull"
-          ]
-        },
-        "percentChangeColorMode": "standard",
-        "orientation": ""
-      },
-      "fieldConfig": {
-        "defaults": {
-          "unit": "watt",
-          "decimals": 0,
-          "thresholds": {
-            "mode": "absolute",
-            "steps": [
-              {
-                "value": null,
-                "color": "green"
-              }
-            ]
-          }
-        },
-        "overrides": []
-      }
-    },
-    {
-      "type": "row",
-      "collapsed": false,
-      "title": "Utilization",
-      "gridPos": {
-        "h": 1,
-        "w": 24,
-        "x": 0,
-        "y": 5
-      },
-      "id": 10,
-      "panels": []
-    },
-    {
-      "type": "timeseries",
-      "id": 11,
-      "targets": [
-        {
-          "expr": "DCGM_FI_DEV_GPU_UTIL{Hostname=~\"$Hostname\"}",
-          "legendFormat": "{{Hostname}}/{{gpu}} {{pod}}",
-          "refId": "A"
-        }
-      ],
-      "title": "GPU Utilization (NVML)",
-      "transparent": false,
-      "datasource": {
-        "type": "prometheus",
-        "uid": "$ds_prometheus"
-      },
-      "gridPos": {
-        "h": 8,
-        "w": 12,
-        "x": 0,
-        "y": 6
-      },
-      "repeatDirection": "h",
-      "options": {
-        "legend": {
-          "displayMode": "table",
-          "placement": "bottom",
-          "showLegend": false,
-          "calcs": [
-            "mean",
-            "max"
-          ]
-        },
-        "tooltip": {
-          "mode": "multi",
-          "sort": ""
-        }
-      },
-      "fieldConfig": {
-        "defaults": {
-          "unit": "percent",
-          "min": 0,
-          "max": 100,
-          "custom": {
-            "drawStyle": "line",
-            "lineInterpolation": "linear",
-            "fillOpacity": 10,
-            "showPoints": "never",
-            "spanNulls": false
-          }
-        },
-        "overrides": []
-      }
-    },
-    {
-      "type": "timeseries",
-      "id": 12,
-      "targets": [
-        {
-          "expr": "DCGM_FI_PROF_PIPE_TENSOR_ACTIVE{Hostname=~\"$Hostname\"} * 100",
-          "legendFormat": "{{Hostname}}/{{gpu}} {{pod}}",
-          "refId": "A"
-        }
-      ],
-      "title": "Tensor Pipe Active (realistic load for LLM/AI)",
-      "transparent": false,
-      "datasource": {
-        "type": "prometheus",
-        "uid": "$ds_prometheus"
-      },
-      "gridPos": {
-        "h": 8,
-        "w": 12,
-        "x": 12,
-        "y": 6
-      },
-      "repeatDirection": "h",
-      "options": {
-        "legend": {
-          "displayMode": "table",
-          "placement": "bottom",
-          "showLegend": false,
-          "calcs": [
-            "mean",
-            "max"
-          ]
-        },
-        "tooltip": {
-          "mode": "multi",
-          "sort": ""
-        }
-      },
-      "fieldConfig": {
-        "defaults": {
-          "unit": "percent",
-          "min": 0,
-          "max": 100,
-          "custom": {
-            "drawStyle": "line",
-            "lineInterpolation": "linear",
-            "fillOpacity": 10,
-            "showPoints": "never",
-            "spanNulls": false
-          }
-        },
-        "overrides": []
-      }
-    },
-    {
-      "type": "timeseries",
-      "id": 13,
-      "targets": [
-        {
-          "expr": "DCGM_FI_PROF_GR_ENGINE_ACTIVE{Hostname=~\"$Hostname\"} * 100",
-          "legendFormat": "{{Hostname}}/{{gpu}} {{pod}}",
-          "refId": "A"
-        }
-      ],
-      "title": "Graphics Engine Active",
-      "transparent": false,
-      "datasource": {
-        "type": "prometheus",
-        "uid": "$ds_prometheus"
-      },
-      "gridPos": {
-        "h": 8,
-        "w": 12,
-        "x": 0,
-        "y": 14
-      },
-      "repeatDirection": "h",
-      "options": {
-        "legend": {
-          "displayMode": "table",
-          "placement": "bottom",
-          "showLegend": false,
-          "calcs": [
-            "mean",
-            "max"
-          ]
-        },
-        "tooltip": {
-          "mode": "multi",
-          "sort": ""
-        }
-      },
-      "fieldConfig": {
-        "defaults": {
-          "unit": "percent",
-          "min": 0,
-          "max": 100,
-          "custom": {
-            "drawStyle": "line",
-            "lineInterpolation": "linear",
-            "fillOpacity": 10,
-            "showPoints": "never",
-            "spanNulls": false
-          }
-        },
-        "overrides": []
-      }
-    },
-    {
-      "type": "timeseries",
-      "id": 14,
-      "targets": [
-        {
-          "expr": "DCGM_FI_DEV_MEM_COPY_UTIL{Hostname=~\"$Hostname\"}",
-          "legendFormat": "{{Hostname}}/{{gpu}} {{pod}}",
-          "refId": "A"
-        }
-      ],
-      "title": "Memory Copy Utilization",
-      "transparent": false,
-      "datasource": {
-        "type": "prometheus",
-        "uid": "$ds_prometheus"
-      },
-      "gridPos": {
-        "h": 8,
-        "w": 12,
-        "x": 12,
-        "y": 14
-      },
-      "repeatDirection": "h",
-      "options": {
-        "legend": {
-          "displayMode": "table",
-          "placement": "bottom",
-          "showLegend": false,
-          "calcs": [
-            "mean",
-            "max"
-          ]
-        },
-        "tooltip": {
-          "mode": "multi",
-          "sort": ""
-        }
-      },
-      "fieldConfig": {
-        "defaults": {
-          "unit": "percent",
-          "min": 0,
-          "max": 100,
-          "custom": {
-            "drawStyle": "line",
-            "lineInterpolation": "linear",
-            "fillOpacity": 10,
-            "showPoints": "never",
-            "spanNulls": false
-          }
-        },
-        "overrides": []
-      }
-    },
-    {
-      "type": "row",
-      "collapsed": false,
-      "title": "Memory",
-      "gridPos": {
-        "h": 1,
-        "w": 24,
-        "x": 0,
-        "y": 22
-      },
-      "id": 20,
-      "panels": []
-    },
-    {
-      "type": "timeseries",
-      "id": 21,
-      "targets": [
-        {
-          "expr": "DCGM_FI_DEV_FB_USED{Hostname=~\"$Hostname\"} * 1048576",
-          "legendFormat": "{{Hostname}}/{{gpu}} {{pod}}",
-          "refId": "A"
-        }
-      ],
-      "title": "VRAM Used",
-      "transparent": false,
-      "datasource": {
-        "type": "prometheus",
-        "uid": "$ds_prometheus"
-      },
-      "gridPos": {
-        "h": 8,
-        "w": 12,
-        "x": 0,
-        "y": 23
-      },
-      "repeatDirection": "h",
-      "options": {
-        "legend": {
-          "displayMode": "table",
-          "placement": "bottom",
-          "showLegend": false,
-          "calcs": [
-            "mean",
-            "max"
-          ]
-        },
-        "tooltip": {
-          "mode": "multi",
-          "sort": ""
-        }
-      },
-      "fieldConfig": {
-        "defaults": {
-          "unit": "bytes",
-          "custom": {
-            "drawStyle": "line",
-            "lineInterpolation": "linear",
-            "fillOpacity": 25,
-            "showPoints": "never"
-          }
-        },
-        "overrides": []
-      }
-    },
-    {
-      "type": "timeseries",
-      "id": 22,
-      "targets": [
-        {
-          "expr": "DCGM_FI_DEV_FB_FREE{Hostname=~\"$Hostname\"} * 1048576",
-          "legendFormat": "{{Hostname}}/{{gpu}}",
-          "refId": "A"
-        }
-      ],
-      "title": "VRAM Free",
-      "transparent": false,
-      "datasource": {
-        "type": "prometheus",
-        "uid": "$ds_prometheus"
-      },
-      "gridPos": {
-        "h": 8,
-        "w": 12,
-        "x": 12,
-        "y": 23
-      },
-      "repeatDirection": "h",
-      "options": {
-        "legend": {
-          "displayMode": "table",
-          "placement": "bottom",
-          "showLegend": false,
-          "calcs": [
-            "mean",
-            "min"
-          ]
-        },
-        "tooltip": {
-          "mode": "multi",
-          "sort": ""
-        }
-      },
-      "fieldConfig": {
-        "defaults": {
-          "unit": "bytes",
-          "custom": {
-            "drawStyle": "line",
-            "lineInterpolation": "linear",
-            "fillOpacity": 10,
-            "showPoints": "never"
-          }
-        },
-        "overrides": []
-      }
-    },
-    {
-      "type": "row",
-      "collapsed": false,
-      "title": "Power \u0026 Temperature",
-      "gridPos": {
-        "h": 1,
-        "w": 24,
-        "x": 0,
-        "y": 31
-      },
-      "id": 30,
-      "panels": []
-    },
-    {
-      "type": "timeseries",
-      "id": 31,
-      "targets": [
-        {
-          "expr": "DCGM_FI_DEV_POWER_USAGE{Hostname=~\"$Hostname\"}",
-          "legendFormat": "{{Hostname}}/{{gpu}}",
-          "refId": "A"
-        }
-      ],
-      "title": "Power Usage per GPU",
-      "description": "Hardware-level metric — shown cluster-wide regardless of namespace filter.",
-      "transparent": false,
-      "datasource": {
-        "type": "prometheus",
-        "uid": "$ds_prometheus"
-      },
-      "gridPos": {
-        "h": 8,
-        "w": 12,
-        "x": 0,
-        "y": 32
-      },
-      "repeatDirection": "h",
-      "options": {
-        "legend": {
-          "displayMode": "table",
-          "placement": "bottom",
-          "showLegend": false,
-          "calcs": [
-            "mean",
-            "max"
-          ]
-        },
-        "tooltip": {
-          "mode": "multi",
-          "sort": ""
-        }
-      },
-      "fieldConfig": {
-        "defaults": {
-          "unit": "watt",
-          "custom": {
-            "drawStyle": "line",
-            "lineInterpolation": "linear",
-            "fillOpacity": 10,
-            "showPoints": "never"
-          }
-        },
-        "overrides": []
-      }
-    },
-    {
-      "type": "timeseries",
-      "id": 32,
-      "targets": [
-        {
-          "expr": "DCGM_FI_DEV_GPU_TEMP{Hostname=~\"$Hostname\"}",
-          "legendFormat": "{{Hostname}}/{{gpu}}",
-          "refId": "A"
-        }
-      ],
-      "title": "GPU Temperature",
-      "description": "Hardware-level metric — shown cluster-wide regardless of namespace filter.",
-      "transparent": false,
-      "datasource": {
-        "type": "prometheus",
-        "uid": "$ds_prometheus"
-      },
-      "gridPos": {
-        "h": 8,
-        "w": 12,
-        "x": 12,
-        "y": 32
-      },
-      "repeatDirection": "h",
-      "options": {
-        "legend": {
-          "displayMode": "table",
-          "placement": "bottom",
-          "showLegend": false,
-          "calcs": [
-            "mean",
-            "max"
-          ]
-        },
-        "tooltip": {
-          "mode": "multi",
-          "sort": ""
-        }
-      },
-      "fieldConfig": {
-        "defaults": {
-          "unit": "celsius",
-          "min": 20,
-          "max": 100,
-          "thresholds": {
-            "mode": "absolute",
-            "steps": [
-              {
-                "value": null,
-                "color": "green"
-              },
-              {
-                "value": 75,
-                "color": "yellow"
-              },
-              {
-                "value": 85,
-                "color": "red"
-              }
-            ]
-          },
-          "custom": {
-            "drawStyle": "line",
-            "lineInterpolation": "linear",
-            "fillOpacity": 10,
-            "showPoints": "never"
-          }
-        },
-        "overrides": []
-      }
-    },
-    {
-      "type": "row",
-      "collapsed": false,
-      "title": "Health",
-      "gridPos": {
-        "h": 1,
-        "w": 24,
-        "x": 0,
-        "y": 40
-      },
-      "id": 40,
-      "panels": []
-    },
-    {
-      "type": "stat",
-      "id": 41,
-      "targets": [
-        {
-          "expr": "max by (Hostname, gpu) (DCGM_FI_DEV_XID_ERRORS{Hostname=~\"$Hostname\"})",
-          "legendFormat": "{{Hostname}}/{{gpu}}",
-          "refId": "A"
-        }
-      ],
-      "title": "XID errors (latest)",
-      "description": "Hardware-level metric — shown cluster-wide regardless of namespace filter.",
-      "transparent": false,
-      "datasource": {
-        "type": "prometheus",
-        "uid": "$ds_prometheus"
-      },
-      "gridPos": {
-        "h": 5,
-        "w": 8,
-        "x": 0,
-        "y": 41
-      },
-      "repeatDirection": "h",
-      "options": {
-        "graphMode": "none",
-        "colorMode": "background",
-        "justifyMode": "auto",
-        "textMode": "value_and_name",
-        "wideLayout": true,
-        "showPercentChange": false,
-        "reduceOptions": {
-          "calcs": [
-            "lastNotNull"
-          ]
-        },
-        "percentChangeColorMode": "standard",
-        "orientation": ""
-      },
-      "fieldConfig": {
-        "defaults": {
-          "unit": "short",
-          "thresholds": {
-            "mode": "absolute",
-            "steps": [
-              {
-                "value": null,
-                "color": "green"
-              },
-              {
-                "value": 1,
-                "color": "red"
-              }
-            ]
-          }
-        },
-        "overrides": []
-      }
-    },
-    {
-      "type": "timeseries",
-      "id": 42,
-      "targets": [
-        {
-          "expr": "rate(DCGM_FI_DEV_POWER_VIOLATION{Hostname=~\"$Hostname\"}[5m])",
-          "legendFormat": "{{Hostname}}/{{gpu}}",
-          "refId": "A"
-        }
-      ],
-      "title": "Power Violation (µs/s throttled due to power)",
-      "description": "Hardware-level metric — shown cluster-wide regardless of namespace filter.",
-      "transparent": false,
-      "datasource": {
-        "type": "prometheus",
-        "uid": "$ds_prometheus"
-      },
-      "gridPos": {
-        "h": 5,
-        "w": 8,
-        "x": 8,
-        "y": 41
-      },
-      "repeatDirection": "h",
-      "options": {
-        "legend": {
-          "displayMode": "list",
-          "placement": "bottom",
-          "showLegend": false,
-          "calcs": []
-        },
-        "tooltip": {
-          "mode": "multi",
-          "sort": ""
-        }
-      },
-      "fieldConfig": {
-        "defaults": {
-          "unit": "µs",
-          "custom": {
-            "drawStyle": "line",
-            "lineInterpolation": "linear",
-            "fillOpacity": 10,
-            "showPoints": "never"
-          }
-        },
-        "overrides": []
-      }
-    },
-    {
-      "type": "timeseries",
-      "id": 43,
-      "targets": [
-        {
-          "expr": "rate(DCGM_FI_DEV_THERMAL_VIOLATION{Hostname=~\"$Hostname\"}[5m])",
-          "legendFormat": "{{Hostname}}/{{gpu}}",
-          "refId": "A"
-        }
-      ],
-      "title": "Thermal Violation (µs/s throttled due to thermals)",
-      "description": "Hardware-level metric — shown cluster-wide regardless of namespace filter.",
-      "transparent": false,
-      "datasource": {
-        "type": "prometheus",
-        "uid": "$ds_prometheus"
-      },
-      "gridPos": {
-        "h": 5,
-        "w": 8,
-        "x": 16,
-        "y": 41
-      },
-      "repeatDirection": "h",
-      "options": {
-        "legend": {
-          "displayMode": "list",
-          "placement": "bottom",
-          "showLegend": false,
-          "calcs": []
-        },
-        "tooltip": {
-          "mode": "multi",
-          "sort": ""
-        }
-      },
-      "fieldConfig": {
-        "defaults": {
-          "unit": "µs",
-          "custom": {
-            "drawStyle": "line",
-            "lineInterpolation": "linear",
-            "fillOpacity": 10,
-            "showPoints": "never"
-          }
-        },
-        "overrides": []
-      }
-    }
-  ],
-  "templating": {
-    "list": [
-      {
-        "type": "datasource",
-        "name": "ds_prometheus",
-        "label": "Prometheus",
-        "skipUrlSync": false,
-        "query": "prometheus",
-        "current": {
-          "selected": false,
-          "text": "default",
-          "value": "default"
-        },
-        "multi": false,
-        "allowCustomValue": true,
-        "includeAll": false,
-        "regex": "",
-        "auto": false,
-        "auto_min": "10s",
-        "auto_count": 30
-      },
-      {
-        "type": "query",
-        "name": "Hostname",
-        "label": "Host",
-        "skipUrlSync": false,
-        "query": "label_values(DCGM_FI_DEV_GPU_UTIL, Hostname)",
-        "datasource": {
-          "type": "prometheus",
-          "uid": "$ds_prometheus"
-        },
-        "current": {
-          "selected": true,
-          "text": "All",
-          "value": "$__all"
-        },
-        "multi": true,
-        "allowCustomValue": true,
-        "refresh": 2,
-        "sort": 1,
-        "includeAll": true,
-        "auto": false,
-        "auto_min": "10s",
-        "auto_count": 30
-      }
-    ]
-  },
-  "annotations": {}
-}
diff --git a/dashboards/gpu/gpu-quotas.json b/dashboards/gpu/gpu-quotas.json
deleted file mode 100644
index 865fb95c..00000000
--- a/dashboards/gpu/gpu-quotas.json
+++ /dev/null
@@ -1,637 +0,0 @@
-{
-  "uid": "gpu-quotas",
-  "title": "GPU Quotas \u0026 Allocation",
-  "tags": [
-    "gpu",
-    "quotas"
-  ],
-  "timezone": "browser",
-  "editable": true,
-  "graphTooltip": 1,
-  "time": {
-    "from": "now-6h",
-    "to": "now"
-  },
-  "fiscalYearStartMonth": 0,
-  "schemaVersion": 42,
-  "panels": [
-    {
-      "type": "row",
-      "collapsed": false,
-      "title": "Allocation overview",
-      "gridPos": {
-        "h": 1,
-        "w": 24,
-        "x": 0,
-        "y": 0
-      },
-      "id": 1,
-      "panels": []
-    },
-    {
-      "type": "stat",
-      "id": 2,
-      "targets": [
-        {
-          "expr": "sum(kube_node_status_allocatable{resource=\"nvidia_com_gpu\"})",
-          "refId": "A"
-        }
-      ],
-      "title": "GPU allocatable",
-      "description": "Total GPU capacity the cluster can schedule to pods.",
-      "transparent": false,
-      "datasource": {
-        "type": "prometheus",
-        "uid": "$ds_prometheus"
-      },
-      "gridPos": {
-        "h": 4,
-        "w": 6,
-        "x": 0,
-        "y": 1
-      },
-      "repeatDirection": "h",
-      "options": {
-        "graphMode": "none",
-        "colorMode": "value",
-        "justifyMode": "auto",
-        "textMode": "value",
-        "wideLayout": true,
-        "showPercentChange": false,
-        "reduceOptions": {
-          "calcs": [
-            "lastNotNull"
-          ]
-        },
-        "percentChangeColorMode": "standard",
-        "orientation": ""
-      },
-      "fieldConfig": {
-        "defaults": {
-          "unit": "short",
-          "thresholds": {
-            "mode": "absolute",
-            "steps": [
-              {
-                "value": null,
-                "color": "blue"
-              }
-            ]
-          }
-        },
-        "overrides": []
-      }
-    },
-    {
-      "type": "stat",
-      "id": 3,
-      "targets": [
-        {
-          "expr": "cluster:gpu_count:allocated",
-          "refId": "A"
-        }
-      ],
-      "title": "GPU requested",
-      "description": "Sum of GPU requests across all pods cluster-wide, including system namespaces.",
-      "transparent": false,
-      "datasource": {
-        "type": "prometheus",
-        "uid": "$ds_prometheus"
-      },
-      "gridPos": {
-        "h": 4,
-        "w": 6,
-        "x": 6,
-        "y": 1
-      },
-      "repeatDirection": "h",
-      "options": {
-        "graphMode": "none",
-        "colorMode": "value",
-        "justifyMode": "auto",
-        "textMode": "value",
-        "wideLayout": true,
-        "showPercentChange": false,
-        "reduceOptions": {
-          "calcs": [
-            "lastNotNull"
-          ]
-        },
-        "percentChangeColorMode": "standard",
-        "orientation": ""
-      },
-      "fieldConfig": {
-        "defaults": {
-          "unit": "short",
-          "thresholds": {
-            "mode": "absolute",
-            "steps": [
-              {
-                "value": null,
-                "color": "green"
-              },
-              {
-                "value": 1,
-                "color": "yellow"
-              }
-            ]
-          }
-        },
-        "overrides": []
-      }
-    },
-    {
-      "type": "gauge",
-      "id": 4,
-      "targets": [
-        {
-          "expr": "cluster:gpu_count:allocated / sum(kube_node_status_allocatable{resource=\"nvidia_com_gpu\"}) * 100",
-          "refId": "A"
-        }
-      ],
-      "title": "Allocation ratio",
-      "description": "Percentage of allocatable GPUs currently requested by pods.",
-      "transparent": false,
-      "datasource": {
-        "type": "prometheus",
-        "uid": "$ds_prometheus"
-      },
-      "gridPos": {
-        "h": 4,
-        "w": 6,
-        "x": 12,
-        "y": 1
-      },
-      "repeatDirection": "h",
-      "options": {
-        "showThresholdLabels": false,
-        "showThresholdMarkers": true,
-        "sizing": "auto",
-        "minVizWidth": 75,
-        "reduceOptions": {
-          "calcs": [
-            "lastNotNull"
-          ]
-        },
-        "minVizHeight": 75,
-        "orientation": ""
-      },
-      "fieldConfig": {
-        "defaults": {
-          "unit": "percent",
-          "min": 0,
-          "max": 100,
-          "thresholds": {
-            "mode": "absolute",
-            "steps": [
-              {
-                "value": null,
-                "color": "blue"
-              },
-              {
-                "value": 40,
-                "color": "green"
-              },
-              {
-                "value": 80,
-                "color": "yellow"
-              },
-              {
-                "value": 95,
-                "color": "red"
-              }
-            ]
-          }
-        },
-        "overrides": []
-      }
-    },
-    {
-      "type": "stat",
-      "id": 5,
-      "targets": [
-        {
-          "expr": "count((sum by (namespace, pod) (kube_pod_container_resource_requests{resource=\"nvidia_com_gpu\"}) \u003e 0) * on(namespace, pod) group_left() (kube_pod_status_phase{phase=\"Pending\"} == 1)) or vector(0)",
-          "refId": "A"
-        }
-      ],
-      "title": "Pending pods (GPU)",
-      "description": "Pods requesting GPUs that are stuck in Pending state — indicates capacity shortage.",
-      "transparent": false,
-      "datasource": {
-        "type": "prometheus",
-        "uid": "$ds_prometheus"
-      },
-      "gridPos": {
-        "h": 4,
-        "w": 6,
-        "x": 18,
-        "y": 1
-      },
-      "repeatDirection": "h",
-      "options": {
-        "graphMode": "none",
-        "colorMode": "background",
-        "justifyMode": "auto",
-        "textMode": "value",
-        "wideLayout": true,
-        "showPercentChange": false,
-        "reduceOptions": {
-          "calcs": [
-            "lastNotNull"
-          ]
-        },
-        "percentChangeColorMode": "standard",
-        "orientation": ""
-      },
-      "fieldConfig": {
-        "defaults": {
-          "unit": "short",
-          "thresholds": {
-            "mode": "absolute",
-            "steps": [
-              {
-                "value": null,
-                "color": "green"
-              },
-              {
-                "value": 1,
-                "color": "red"
-              }
-            ]
-          }
-        },
-        "overrides": []
-      }
-    },
-    {
-      "type": "row",
-      "collapsed": false,
-      "title": "Per namespace",
-      "gridPos": {
-        "h": 1,
-        "w": 24,
-        "x": 0,
-        "y": 5
-      },
-      "id": 10,
-      "panels": []
-    },
-    {
-      "type": "bargauge",
-      "id": 11,
-      "targets": [
-        {
-          "expr": "sum by (namespace) (namespace:gpu_count:allocated{namespace=~\"$namespace\"})",
-          "legendFormat": "{{namespace}}",
-          "refId": "A"
-        }
-      ],
-      "title": "GPU requested per namespace",
-      "description": "GPU allocation breakdown by namespace — spot top consumers at a glance.",
-      "transparent": false,
-      "datasource": {
-        "type": "prometheus",
-        "uid": "$ds_prometheus"
-      },
-      "gridPos": {
-        "h": 8,
-        "w": 12,
-        "x": 0,
-        "y": 6
-      },
-      "repeatDirection": "h",
-      "options": {
-        "displayMode": "gradient",
-        "valueMode": "color",
-        "namePlacement": "auto",
-        "showUnfilled": true,
-        "sizing": "auto",
-        "minVizWidth": 8,
-        "minVizHeight": 16,
-        "legend": {
-          "displayMode": "list",
-          "placement": "bottom",
-          "showLegend": false,
-          "calcs": []
-        },
-        "reduceOptions": {
-          "calcs": [
-            "lastNotNull"
-          ]
-        },
-        "maxVizHeight": 300,
-        "orientation": "horizontal"
-      },
-      "fieldConfig": {
-        "defaults": {
-          "unit": "short",
-          "min": 0,
-          "max": 8,
-          "thresholds": {
-            "mode": "absolute",
-            "steps": [
-              {
-                "value": null,
-                "color": "green"
-              }
-            ]
-          }
-        },
-        "overrides": []
-      }
-    },
-    {
-      "type": "timeseries",
-      "id": 12,
-      "targets": [
-        {
-          "expr": "sum(kube_node_status_allocatable{resource=\"nvidia_com_gpu\"})",
-          "legendFormat": "Allocatable (total)",
-          "refId": "A"
-        },
-        {
-          "expr": "sum(namespace:gpu_count:allocated{namespace=~\"$namespace\"})",
-          "legendFormat": "Requested",
-          "refId": "B"
-        }
-      ],
-      "title": "GPU allocated over time",
-      "description": "Requested vs allocatable GPUs over time — shows allocation pressure trends.",
-      "transparent": false,
-      "datasource": {
-        "type": "prometheus",
-        "uid": "$ds_prometheus"
-      },
-      "gridPos": {
-        "h": 8,
-        "w": 12,
-        "x": 12,
-        "y": 6
-      },
-      "repeatDirection": "h",
-      "options": {
-        "legend": {
-          "displayMode": "list",
-          "placement": "bottom",
-          "showLegend": false,
-          "calcs": []
-        },
-        "tooltip": {
-          "mode": "multi",
-          "sort": ""
-        }
-      },
-      "fieldConfig": {
-        "defaults": {
-          "unit": "short",
-          "custom": {
-            "drawStyle": "line",
-            "lineInterpolation": "stepAfter",
-            "fillOpacity": 10,
-            "showPoints": "never"
-          }
-        },
-        "overrides": [
-          {
-            "matcher": {
-              "id": "byName",
-              "options": "Allocatable (total)"
-            },
-            "properties": [
-              {
-                "id": "color",
-                "value": {
-                  "fixedColor": "blue",
-                  "mode": "fixed"
-                }
-              }
-            ]
-          }
-        ]
-      }
-    },
-    {
-      "type": "row",
-      "collapsed": false,
-      "title": "Pods with GPU",
-      "gridPos": {
-        "h": 1,
-        "w": 24,
-        "x": 0,
-        "y": 14
-      },
-      "id": 20,
-      "panels": []
-    },
-    {
-      "type": "table",
-      "id": 21,
-      "targets": [
-        {
-          "expr": "kube_pod_container_resource_requests{resource=\"nvidia_com_gpu\", namespace=~\"$namespace\"} * on(namespace, pod) group_left(phase) (kube_pod_status_phase{phase=~\"Running|Pending\"} == 1)",
-          "instant": true,
-          "range": false,
-          "format": "table",
-          "refId": "requested"
-        },
-        {
-          "expr": "kube_pod_container_resource_limits{resource=\"nvidia_com_gpu\", namespace=~\"$namespace\"} * on(namespace, pod) group_left() (kube_pod_status_phase{phase=~\"Running|Pending\"} == 1)",
-          "instant": true,
-          "range": false,
-          "format": "table",
-          "refId": "limits"
-        }
-      ],
-      "title": "Pods requesting GPU",
-      "description": "Per-pod GPU requests and limits with scheduling status — Running or Pending.",
-      "transparent": false,
-      "datasource": {
-        "type": "prometheus",
-        "uid": "$ds_prometheus"
-      },
-      "gridPos": {
-        "h": 10,
-        "w": 24,
-        "x": 0,
-        "y": 15
-      },
-      "repeatDirection": "h",
-      "transformations": [
-        {
-          "id": "joinByField",
-          "options": {
-            "byField": "pod",
-            "mode": "outer"
-          }
-        },
-        {
-          "id": "organize",
-          "options": {
-            "excludeByName": {
-              "Time": true,
-              "Time 1": true,
-              "Time 2": true,
-              "__name__": true,
-              "__name__ 1": true,
-              "__name__ 2": true,
-              "cluster": true,
-              "cluster 1": true,
-              "cluster 2": true,
-              "container 2": true,
-              "endpoint": true,
-              "endpoint 1": true,
-              "endpoint 2": true,
-              "instance": true,
-              "instance 1": true,
-              "instance 2": true,
-              "job": true,
-              "job 1": true,
-              "job 2": true,
-              "namespace 2": true,
-              "node 2": true,
-              "prometheus": true,
-              "prometheus 1": true,
-              "prometheus 2": true,
-              "resource": true,
-              "resource 1": true,
-              "resource 2": true,
-              "service": true,
-              "service 1": true,
-              "service 2": true,
-              "tenant": true,
-              "tenant 1": true,
-              "tenant 2": true,
-              "tier": true,
-              "tier 1": true,
-              "tier 2": true,
-              "uid": true,
-              "uid 1": true,
-              "uid 2": true,
-              "unit": true,
-              "unit 1": true,
-              "unit 2": true
-            },
-            "indexByName": {
-              "Value #limits": 5,
-              "Value #requested": 4,
-              "container 1": 2,
-              "namespace 1": 0,
-              "node 1": 3,
-              "phase": 6,
-              "pod": 1
-            },
-            "renameByName": {
-              "Value #limits": "Limit",
-              "Value #requested": "Req",
-              "container 1": "Container",
-              "namespace 1": "Namespace",
-              "node 1": "Node",
-              "phase": "Status"
-            }
-          }
-        }
-      ],
-      "options": {
-        "frameIndex": 0,
-        "showHeader": true,
-        "showTypeIcons": false,
-        "footer": {
-          "show": false,
-          "reducer": []
-        },
-        "cellHeight": "sm"
-      },
-      "fieldConfig": {
-        "defaults": {},
-        "overrides": [
-          {
-            "matcher": {
-              "id": "byName",
-              "options": "Status"
-            },
-            "properties": [
-              {
-                "id": "custom.cellOptions",
-                "value": {
-                  "mode": "basic",
-                  "type": "color-background"
-                }
-              },
-              {
-                "id": "mappings",
-                "value": [
-                  {
-                    "options": {
-                      "Failed": {
-                        "color": "red",
-                        "index": 2
-                      },
-                      "Pending": {
-                        "color": "orange",
-                        "index": 1
-                      },
-                      "Running": {
-                        "color": "green",
-                        "index": 0
-                      }
-                    },
-                    "type": "value"
-                  }
-                ]
-              }
-            ]
-          }
-        ]
-      }
-    }
-  ],
-  "templating": {
-    "list": [
-      {
-        "type": "datasource",
-        "name": "ds_prometheus",
-        "label": "Prometheus",
-        "skipUrlSync": false,
-        "query": "prometheus",
-        "current": {
-          "selected": false,
-          "text": "default",
-          "value": "default"
-        },
-        "multi": false,
-        "allowCustomValue": true,
-        "includeAll": false,
-        "regex": "",
-        "auto": false,
-        "auto_min": "10s",
-        "auto_count": 30
-      },
-      {
-        "type": "query",
-        "name": "namespace",
-        "label": "Namespace",
-        "skipUrlSync": false,
-        "query": "label_values(kube_pod_container_resource_requests{resource=\"nvidia_com_gpu\"}, namespace)",
-        "datasource": {
-          "type": "prometheus",
-          "uid": "$ds_prometheus"
-        },
-        "current": {
-          "selected": true,
-          "text": "All",
-          "value": "$__all"
-        },
-        "multi": true,
-        "allowCustomValue": true,
-        "refresh": 2,
-        "sort": 1,
-        "includeAll": true,
-        "auto": false,
-        "auto_min": "10s",
-        "auto_count": 30
-      }
-    ]
-  },
-  "annotations": {}
-}
diff --git a/dashboards/gpu/gpu-tenants.json b/dashboards/gpu/gpu-tenants.json
deleted file mode 100644
index 7fef321d..00000000
--- a/dashboards/gpu/gpu-tenants.json
+++ /dev/null
@@ -1,1098 +0,0 @@
-{
-  "uid": "gpu-tenants",
-  "title": "GPU Tenant Usage",
-  "description": "Per-tenant GPU consumption: live allocation, utilization, tensor saturation, power, and 24h GPU-hours / kWh — admin view across all namespaces.",
-  "tags": [
-    "gpu",
-    "tenants",
-    "admin"
-  ],
-  "timezone": "browser",
-  "editable": true,
-  "graphTooltip": 1,
-  "time": {
-    "from": "now-24h",
-    "to": "now"
-  },
-  "fiscalYearStartMonth": 0,
-  "schemaVersion": 42,
-  "panels": [
-    {
-      "type": "row",
-      "collapsed": false,
-      "title": "Tenant fleet snapshot",
-      "gridPos": {
-        "h": 1,
-        "w": 24,
-        "x": 0,
-        "y": 0
-      },
-      "id": 1,
-      "panels": []
-    },
-    {
-      "type": "stat",
-      "id": 2,
-      "targets": [
-        {
-          "expr": "count(namespace:gpu_count:allocated{namespace=~\"$namespace\"} \u003e 0)",
-          "refId": "A"
-        }
-      ],
-      "title": "Active tenants",
-      "description": "Namespaces with at least one GPU request (Pending + Running).",
-      "transparent": false,
-      "datasource": {
-        "type": "prometheus",
-        "uid": "$ds_prometheus"
-      },
-      "gridPos": {
-        "h": 4,
-        "w": 4,
-        "x": 0,
-        "y": 1
-      },
-      "repeatDirection": "h",
-      "options": {
-        "graphMode": "none",
-        "colorMode": "value",
-        "justifyMode": "auto",
-        "textMode": "value",
-        "wideLayout": true,
-        "showPercentChange": false,
-        "reduceOptions": {
-          "calcs": [
-            "lastNotNull"
-          ]
-        },
-        "percentChangeColorMode": "standard",
-        "orientation": ""
-      },
-      "fieldConfig": {
-        "defaults": {
-          "unit": "short",
-          "thresholds": {
-            "mode": "absolute",
-            "steps": [
-              {
-                "value": null,
-                "color": "blue"
-              }
-            ]
-          }
-        },
-        "overrides": []
-      }
-    },
-    {
-      "type": "stat",
-      "id": 3,
-      "targets": [
-        {
-          "expr": "sum(namespace:gpu_count:allocated{namespace=~\"$namespace\"})",
-          "refId": "A"
-        }
-      ],
-      "title": "Allocated GPUs",
-      "description": "Sum of kube GPU requests across tenants. Billable view — includes Pending pods.",
-      "transparent": false,
-      "datasource": {
-        "type": "prometheus",
-        "uid": "$ds_prometheus"
-      },
-      "gridPos": {
-        "h": 4,
-        "w": 4,
-        "x": 4,
-        "y": 1
-      },
-      "repeatDirection": "h",
-      "options": {
-        "graphMode": "none",
-        "colorMode": "background",
-        "justifyMode": "auto",
-        "textMode": "value",
-        "wideLayout": true,
-        "showPercentChange": false,
-        "reduceOptions": {
-          "calcs": [
-            "lastNotNull"
-          ]
-        },
-        "percentChangeColorMode": "standard",
-        "orientation": ""
-      },
-      "fieldConfig": {
-        "defaults": {
-          "unit": "short",
-          "thresholds": {
-            "mode": "absolute",
-            "steps": [
-              {
-                "value": null,
-                "color": "blue"
-              },
-              {
-                "value": 1,
-                "color": "green"
-              }
-            ]
-          }
-        },
-        "overrides": []
-      }
-    },
-    {
-      "type": "stat",
-      "id": 4,
-      "targets": [
-        {
-          "expr": "cluster:gpu_util:avg",
-          "refId": "A"
-        }
-      ],
-      "title": "Avg cluster GPU util",
-      "description": "Average NVML utilization across all GPUs in the cluster. Cluster-wide — DCGM hardware metrics cannot be attributed to workload namespaces.",
-      "transparent": false,
-      "datasource": {
-        "type": "prometheus",
-        "uid": "$ds_prometheus"
-      },
-      "gridPos": {
-        "h": 4,
-        "w": 4,
-        "x": 8,
-        "y": 1
-      },
-      "repeatDirection": "h",
-      "options": {
-        "graphMode": "area",
-        "colorMode": "value",
-        "justifyMode": "auto",
-        "textMode": "value",
-        "wideLayout": true,
-        "showPercentChange": false,
-        "reduceOptions": {
-          "calcs": [
-            "lastNotNull"
-          ]
-        },
-        "percentChangeColorMode": "standard",
-        "orientation": ""
-      },
-      "fieldConfig": {
-        "defaults": {
-          "unit": "percent",
-          "min": 0,
-          "max": 100,
-          "thresholds": {
-            "mode": "absolute",
-            "steps": [
-              {
-                "value": null,
-                "color": "blue"
-              },
-              {
-                "value": 30,
-                "color": "green"
-              },
-              {
-                "value": 80,
-                "color": "orange"
-              }
-            ]
-          }
-        },
-        "overrides": []
-      }
-    },
-    {
-      "type": "stat",
-      "id": 5,
-      "targets": [
-        {
-          "expr": "cluster:gpu_power_watts:sum",
-          "refId": "A"
-        }
-      ],
-      "title": "Total GPU power",
-      "description": "Live power draw summed across all GPUs in the cluster. Cluster-wide — DCGM hardware metrics cannot be attributed to workload namespaces.",
-      "transparent": false,
-      "datasource": {
-        "type": "prometheus",
-        "uid": "$ds_prometheus"
-      },
-      "gridPos": {
-        "h": 4,
-        "w": 4,
-        "x": 12,
-        "y": 1
-      },
-      "repeatDirection": "h",
-      "options": {
-        "graphMode": "area",
-        "colorMode": "value",
-        "justifyMode": "auto",
-        "textMode": "value",
-        "wideLayout": true,
-        "showPercentChange": false,
-        "reduceOptions": {
-          "calcs": [
-            "lastNotNull"
-          ]
-        },
-        "percentChangeColorMode": "standard",
-        "orientation": ""
-      },
-      "fieldConfig": {
-        "defaults": {
-          "unit": "watt",
-          "decimals": 0,
-          "thresholds": {
-            "mode": "absolute",
-            "steps": [
-              {
-                "value": null,
-                "color": "green"
-              }
-            ]
-          }
-        },
-        "overrides": []
-      }
-    },
-    {
-      "type": "stat",
-      "id": 6,
-      "targets": [
-        {
-          "expr": "sum(sum_over_time(node:power_watts:sum[24h:1m])) / 60 / 1000",
-          "refId": "A"
-        }
-      ],
-      "title": "Energy (last 24h)",
-      "description": "Integrated cluster-wide GPU power draw over 24h. Cluster-wide — DCGM hardware metrics cannot be attributed to workload namespaces.",
-      "transparent": false,
-      "datasource": {
-        "type": "prometheus",
-        "uid": "$ds_prometheus"
-      },
-      "gridPos": {
-        "h": 4,
-        "w": 4,
-        "x": 16,
-        "y": 1
-      },
-      "repeatDirection": "h",
-      "options": {
-        "graphMode": "none",
-        "colorMode": "value",
-        "justifyMode": "auto",
-        "textMode": "value",
-        "wideLayout": true,
-        "showPercentChange": false,
-        "reduceOptions": {
-          "calcs": [
-            "lastNotNull"
-          ]
-        },
-        "percentChangeColorMode": "standard",
-        "orientation": ""
-      },
-      "fieldConfig": {
-        "defaults": {
-          "unit": "kwatth",
-          "decimals": 1,
-          "thresholds": {
-            "mode": "absolute",
-            "steps": [
-              {
-                "value": null,
-                "color": "green"
-              }
-            ]
-          }
-        },
-        "overrides": []
-      }
-    },
-    {
-      "type": "stat",
-      "id": 7,
-      "targets": [
-        {
-          "expr": "sum(sum_over_time(namespace:gpu_count:allocated{namespace=~\"$namespace\"}[24h:1m])) / 60",
-          "refId": "A"
-        }
-      ],
-      "title": "GPU-hours (last 24h)",
-      "description": "Sum of (GPU count × time requested) across all tenants over the last 24h. Integrated from kube requests, so Pending pods count.",
-      "transparent": false,
-      "datasource": {
-        "type": "prometheus",
-        "uid": "$ds_prometheus"
-      },
-      "gridPos": {
-        "h": 4,
-        "w": 4,
-        "x": 20,
-        "y": 1
-      },
-      "repeatDirection": "h",
-      "options": {
-        "graphMode": "none",
-        "colorMode": "value",
-        "justifyMode": "auto",
-        "textMode": "value",
-        "wideLayout": true,
-        "showPercentChange": false,
-        "reduceOptions": {
-          "calcs": [
-            "lastNotNull"
-          ]
-        },
-        "percentChangeColorMode": "standard",
-        "orientation": ""
-      },
-      "fieldConfig": {
-        "defaults": {
-          "unit": "short",
-          "decimals": 1,
-          "thresholds": {
-            "mode": "absolute",
-            "steps": [
-              {
-                "value": null,
-                "color": "blue"
-              }
-            ]
-          }
-        },
-        "overrides": []
-      }
-    },
-    {
-      "type": "row",
-      "collapsed": false,
-      "title": "Current allocation",
-      "gridPos": {
-        "h": 1,
-        "w": 24,
-        "x": 0,
-        "y": 5
-      },
-      "id": 10,
-      "panels": []
-    },
-    {
-      "type": "bargauge",
-      "id": 11,
-      "targets": [
-        {
-          "expr": "namespace:gpu_count:allocated{namespace=~\"$namespace\"}",
-          "legendFormat": "{{namespace}}",
-          "refId": "A"
-        }
-      ],
-      "title": "GPUs per namespace",
-      "description": "Kube GPU requests per tenant (billable). Includes Pending pods.",
-      "transparent": false,
-      "datasource": {
-        "type": "prometheus",
-        "uid": "$ds_prometheus"
-      },
-      "gridPos": {
-        "h": 8,
-        "w": 12,
-        "x": 0,
-        "y": 6
-      },
-      "repeatDirection": "h",
-      "options": {
-        "displayMode": "gradient",
-        "valueMode": "color",
-        "namePlacement": "auto",
-        "showUnfilled": true,
-        "sizing": "auto",
-        "minVizWidth": 8,
-        "minVizHeight": 16,
-        "legend": {
-          "displayMode": "list",
-          "placement": "bottom",
-          "showLegend": false,
-          "calcs": []
-        },
-        "reduceOptions": {
-          "calcs": [
-            "lastNotNull"
-          ]
-        },
-        "maxVizHeight": 300,
-        "orientation": "horizontal"
-      },
-      "fieldConfig": {
-        "defaults": {
-          "unit": "short",
-          "min": 0,
-          "thresholds": {
-            "mode": "absolute",
-            "steps": [
-              {
-                "value": null,
-                "color": "green"
-              }
-            ]
-          }
-        },
-        "overrides": []
-      }
-    },
-    {
-      "type": "bargauge",
-      "id": 12,
-      "targets": [
-        {
-          "expr": "node:fb_used_bytes:sum",
-          "legendFormat": "{{Hostname}}",
-          "refId": "A"
-        }
-      ],
-      "title": "VRAM used per node",
-      "description": "FB memory actively used per node. DCGM hardware metrics cannot be attributed to workload namespaces — shown per-node instead.",
-      "transparent": false,
-      "datasource": {
-        "type": "prometheus",
-        "uid": "$ds_prometheus"
-      },
-      "gridPos": {
-        "h": 8,
-        "w": 12,
-        "x": 12,
-        "y": 6
-      },
-      "repeatDirection": "h",
-      "options": {
-        "displayMode": "gradient",
-        "valueMode": "color",
-        "namePlacement": "auto",
-        "showUnfilled": true,
-        "sizing": "auto",
-        "minVizWidth": 8,
-        "minVizHeight": 16,
-        "legend": {
-          "displayMode": "list",
-          "placement": "bottom",
-          "showLegend": false,
-          "calcs": []
-        },
-        "reduceOptions": {
-          "calcs": [
-            "lastNotNull"
-          ]
-        },
-        "maxVizHeight": 300,
-        "orientation": "horizontal"
-      },
-      "fieldConfig": {
-        "defaults": {
-          "unit": "bytes",
-          "min": 0,
-          "thresholds": {
-            "mode": "absolute",
-            "steps": [
-              {
-                "value": null,
-                "color": "green"
-              }
-            ]
-          }
-        },
-        "overrides": []
-      }
-    },
-    {
-      "type": "row",
-      "collapsed": false,
-      "title": "Utilization (per-node)",
-      "gridPos": {
-        "h": 1,
-        "w": 24,
-        "x": 0,
-        "y": 14
-      },
-      "id": 20,
-      "panels": []
-    },
-    {
-      "type": "timeseries",
-      "id": 21,
-      "targets": [
-        {
-          "expr": "node:gpu_util:avg",
-          "legendFormat": "{{Hostname}}",
-          "refId": "A"
-        }
-      ],
-      "title": "NVML utilization per node",
-      "description": "Per-node NVML utilization. Stacked to show fleet-wide pressure over time. DCGM hardware metrics cannot be attributed to workload namespaces — shown per-node instead.",
-      "transparent": false,
-      "datasource": {
-        "type": "prometheus",
-        "uid": "$ds_prometheus"
-      },
-      "gridPos": {
-        "h": 8,
-        "w": 12,
-        "x": 0,
-        "y": 15
-      },
-      "repeatDirection": "h",
-      "options": {
-        "legend": {
-          "displayMode": "table",
-          "placement": "bottom",
-          "showLegend": false,
-          "calcs": [
-            "mean",
-            "max"
-          ]
-        },
-        "tooltip": {
-          "mode": "multi",
-          "sort": ""
-        }
-      },
-      "fieldConfig": {
-        "defaults": {
-          "unit": "percent",
-          "min": 0,
-          "custom": {
-            "drawStyle": "line",
-            "lineInterpolation": "linear",
-            "fillOpacity": 40,
-            "showPoints": "never",
-            "stacking": {
-              "mode": "normal"
-            }
-          }
-        },
-        "overrides": []
-      }
-    },
-    {
-      "type": "timeseries",
-      "id": 22,
-      "targets": [
-        {
-          "expr": "node:tensor_active:avg * 100",
-          "legendFormat": "{{Hostname}}",
-          "refId": "A"
-        }
-      ],
-      "title": "Tensor saturation per node",
-      "description": "Real tensor core load per node. Useful to spot nodes with idle tensor cores. DCGM hardware metrics cannot be attributed to workload namespaces — shown per-node instead.",
-      "transparent": false,
-      "datasource": {
-        "type": "prometheus",
-        "uid": "$ds_prometheus"
-      },
-      "gridPos": {
-        "h": 8,
-        "w": 12,
-        "x": 12,
-        "y": 15
-      },
-      "repeatDirection": "h",
-      "options": {
-        "legend": {
-          "displayMode": "table",
-          "placement": "bottom",
-          "showLegend": false,
-          "calcs": [
-            "mean",
-            "max"
-          ]
-        },
-        "tooltip": {
-          "mode": "multi",
-          "sort": ""
-        }
-      },
-      "fieldConfig": {
-        "defaults": {
-          "unit": "percent",
-          "min": 0,
-          "custom": {
-            "drawStyle": "line",
-            "lineInterpolation": "linear",
-            "fillOpacity": 40,
-            "showPoints": "never",
-            "stacking": {
-              "mode": "normal"
-            }
-          }
-        },
-        "overrides": []
-      }
-    },
-    {
-      "type": "row",
-      "collapsed": false,
-      "title": "Power \u0026 allocation trend",
-      "gridPos": {
-        "h": 1,
-        "w": 24,
-        "x": 0,
-        "y": 23
-      },
-      "id": 30,
-      "panels": []
-    },
-    {
-      "type": "timeseries",
-      "id": 31,
-      "targets": [
-        {
-          "expr": "node:power_watts:sum",
-          "legendFormat": "{{Hostname}}",
-          "refId": "A"
-        }
-      ],
-      "title": "Power draw per node",
-      "description": "Per-node GPU power draw. Stacked to see cluster-wide energy burn over time. DCGM hardware metrics cannot be attributed to workload namespaces — shown per-node instead.",
-      "transparent": false,
-      "datasource": {
-        "type": "prometheus",
-        "uid": "$ds_prometheus"
-      },
-      "gridPos": {
-        "h": 8,
-        "w": 12,
-        "x": 0,
-        "y": 24
-      },
-      "repeatDirection": "h",
-      "options": {
-        "legend": {
-          "displayMode": "table",
-          "placement": "bottom",
-          "showLegend": false,
-          "calcs": [
-            "mean",
-            "max"
-          ]
-        },
-        "tooltip": {
-          "mode": "multi",
-          "sort": ""
-        }
-      },
-      "fieldConfig": {
-        "defaults": {
-          "unit": "watt",
-          "min": 0,
-          "custom": {
-            "drawStyle": "line",
-            "lineInterpolation": "linear",
-            "fillOpacity": 40,
-            "showPoints": "never",
-            "stacking": {
-              "mode": "normal"
-            }
-          }
-        },
-        "overrides": []
-      }
-    },
-    {
-      "type": "timeseries",
-      "id": 32,
-      "targets": [
-        {
-          "expr": "namespace:gpu_count:allocated{namespace=~\"$namespace\"}",
-          "legendFormat": "{{namespace}}",
-          "refId": "A"
-        }
-      ],
-      "title": "Allocated GPUs per namespace",
-      "description": "Kube-requested GPU count per tenant over time. Step-after interpolation reflects discrete allocation changes.",
-      "transparent": false,
-      "datasource": {
-        "type": "prometheus",
-        "uid": "$ds_prometheus"
-      },
-      "gridPos": {
-        "h": 8,
-        "w": 12,
-        "x": 12,
-        "y": 24
-      },
-      "repeatDirection": "h",
-      "options": {
-        "legend": {
-          "displayMode": "table",
-          "placement": "bottom",
-          "showLegend": false,
-          "calcs": [
-            "mean",
-            "max"
-          ]
-        },
-        "tooltip": {
-          "mode": "multi",
-          "sort": ""
-        }
-      },
-      "fieldConfig": {
-        "defaults": {
-          "unit": "short",
-          "min": 0,
-          "custom": {
-            "drawStyle": "line",
-            "lineInterpolation": "stepAfter",
-            "fillOpacity": 40,
-            "showPoints": "never",
-            "stacking": {
-              "mode": "normal"
-            }
-          }
-        },
-        "overrides": []
-      }
-    },
-    {
-      "type": "row",
-      "collapsed": false,
-      "title": "Top consumers (live)",
-      "gridPos": {
-        "h": 1,
-        "w": 24,
-        "x": 0,
-        "y": 32
-      },
-      "id": 40,
-      "panels": []
-    },
-    {
-      "type": "table",
-      "id": 41,
-      "targets": [
-        {
-          "expr": "namespace:gpu_count:allocated{namespace=~\"$namespace\"}",
-          "instant": true,
-          "range": false,
-          "format": "table",
-          "refId": "gpus"
-        }
-      ],
-      "title": "Top consumers (allocation)",
-      "description": "Live ranking of tenants by GPU allocation. Hardware metrics (util, tensor, power, VRAM) cannot be attributed to workload namespaces — see Fleet and Performance dashboards for per-node/per-GPU hardware views.",
-      "transparent": false,
-      "datasource": {
-        "type": "prometheus",
-        "uid": "$ds_prometheus"
-      },
-      "gridPos": {
-        "h": 10,
-        "w": 24,
-        "x": 0,
-        "y": 33
-      },
-      "repeatDirection": "h",
-      "transformations": [
-        {
-          "id": "organize",
-          "options": {
-            "excludeByName": {
-              "Time": true,
-              "Time 1": true,
-              "Time 2": true,
-              "Time 3": true,
-              "Time 4": true,
-              "Time 5": true,
-              "__name__": true,
-              "__name__ 1": true,
-              "__name__ 2": true,
-              "__name__ 3": true,
-              "__name__ 4": true,
-              "__name__ 5": true,
-              "cluster": true,
-              "cluster 1": true,
-              "cluster 2": true,
-              "cluster 3": true,
-              "cluster 4": true,
-              "cluster 5": true,
-              "endpoint": true,
-              "endpoint 1": true,
-              "endpoint 2": true,
-              "endpoint 3": true,
-              "endpoint 4": true,
-              "endpoint 5": true,
-              "instance": true,
-              "instance 1": true,
-              "instance 2": true,
-              "instance 3": true,
-              "instance 4": true,
-              "instance 5": true,
-              "job": true,
-              "job 1": true,
-              "job 2": true,
-              "job 3": true,
-              "job 4": true,
-              "job 5": true,
-              "prometheus": true,
-              "prometheus 1": true,
-              "prometheus 2": true,
-              "prometheus 3": true,
-              "prometheus 4": true,
-              "prometheus 5": true,
-              "service": true,
-              "service 1": true,
-              "service 2": true,
-              "service 3": true,
-              "service 4": true,
-              "service 5": true,
-              "tenant": true,
-              "tenant 1": true,
-              "tenant 2": true,
-              "tenant 3": true,
-              "tenant 4": true,
-              "tenant 5": true,
-              "tier": true,
-              "tier 1": true,
-              "tier 2": true,
-              "tier 3": true,
-              "tier 4": true,
-              "tier 5": true,
-              "uid": true,
-              "uid 1": true,
-              "uid 2": true,
-              "uid 3": true,
-              "uid 4": true,
-              "uid 5": true,
-              "unit": true,
-              "unit 1": true,
-              "unit 2": true,
-              "unit 3": true,
-              "unit 4": true,
-              "unit 5": true
-            },
-            "indexByName": {
-              "Value #gpus": 1,
-              "namespace": 0
-            },
-            "renameByName": {
-              "Value #gpus": "GPUs",
-              "namespace": "Namespace"
-            }
-          }
-        }
-      ],
-      "options": {
-        "frameIndex": 0,
-        "showHeader": true,
-        "showTypeIcons": false,
-        "sortBy": [
-          {
-            "displayName": "GPUs",
-            "desc": true
-          }
-        ],
-        "footer": {
-          "show": false,
-          "reducer": []
-        },
-        "cellHeight": "sm"
-      }
-    },
-    {
-      "type": "row",
-      "collapsed": false,
-      "title": "Historical usage (last 24h)",
-      "gridPos": {
-        "h": 1,
-        "w": 24,
-        "x": 0,
-        "y": 43
-      },
-      "id": 50,
-      "panels": []
-    },
-    {
-      "type": "bargauge",
-      "id": 51,
-      "targets": [
-        {
-          "expr": "sum_over_time(namespace:gpu_count:allocated{namespace=~\"$namespace\"}[24h:1m]) / 60",
-          "legendFormat": "{{namespace}}",
-          "refId": "A"
-        }
-      ],
-      "title": "GPU-hours per namespace (last 24h)",
-      "description": "Billable GPU-hours per tenant over the last 24h window.",
-      "transparent": false,
-      "datasource": {
-        "type": "prometheus",
-        "uid": "$ds_prometheus"
-      },
-      "gridPos": {
-        "h": 7,
-        "w": 12,
-        "x": 0,
-        "y": 44
-      },
-      "repeatDirection": "h",
-      "options": {
-        "displayMode": "gradient",
-        "valueMode": "color",
-        "namePlacement": "auto",
-        "showUnfilled": true,
-        "sizing": "auto",
-        "minVizWidth": 8,
-        "minVizHeight": 16,
-        "legend": {
-          "displayMode": "list",
-          "placement": "bottom",
-          "showLegend": false,
-          "calcs": []
-        },
-        "reduceOptions": {
-          "calcs": [
-            "lastNotNull"
-          ]
-        },
-        "maxVizHeight": 300,
-        "orientation": "horizontal"
-      },
-      "fieldConfig": {
-        "defaults": {
-          "unit": "short",
-          "decimals": 1,
-          "min": 0,
-          "thresholds": {
-            "mode": "absolute",
-            "steps": [
-              {
-                "value": null,
-                "color": "blue"
-              }
-            ]
-          }
-        },
-        "overrides": []
-      }
-    },
-    {
-      "type": "bargauge",
-      "id": 52,
-      "targets": [
-        {
-          "expr": "sum_over_time(node:power_watts:sum[24h:1m]) / 60 / 1000",
-          "legendFormat": "{{Hostname}}",
-          "refId": "A"
-        }
-      ],
-      "title": "Energy per node (last 24h)",
-      "description": "kWh consumed per node over the last 24h. Integrated from 1-minute power samples. DCGM hardware metrics cannot be attributed to workload namespaces — shown per-node instead.",
-      "transparent": false,
-      "datasource": {
-        "type": "prometheus",
-        "uid": "$ds_prometheus"
-      },
-      "gridPos": {
-        "h": 7,
-        "w": 12,
-        "x": 12,
-        "y": 44
-      },
-      "repeatDirection": "h",
-      "options": {
-        "displayMode": "gradient",
-        "valueMode": "color",
-        "namePlacement": "auto",
-        "showUnfilled": true,
-        "sizing": "auto",
-        "minVizWidth": 8,
-        "minVizHeight": 16,
-        "legend": {
-          "displayMode": "list",
-          "placement": "bottom",
-          "showLegend": false,
-          "calcs": []
-        },
-        "reduceOptions": {
-          "calcs": [
-            "lastNotNull"
-          ]
-        },
-        "maxVizHeight": 300,
-        "orientation": "horizontal"
-      },
-      "fieldConfig": {
-        "defaults": {
-          "unit": "kwatth",
-          "decimals": 2,
-          "min": 0,
-          "thresholds": {
-            "mode": "absolute",
-            "steps": [
-              {
-                "value": null,
-                "color": "green"
-              }
-            ]
-          }
-        },
-        "overrides": []
-      }
-    }
-  ],
-  "templating": {
-    "list": [
-      {
-        "type": "datasource",
-        "name": "ds_prometheus",
-        "label": "Prometheus",
-        "skipUrlSync": false,
-        "query": "prometheus",
-        "current": {
-          "selected": false,
-          "text": "default",
-          "value": "default"
-        },
-        "multi": false,
-        "allowCustomValue": true,
-        "includeAll": false,
-        "regex": "",
-        "auto": false,
-        "auto_min": "10s",
-        "auto_count": 30
-      },
-      {
-        "type": "query",
-        "name": "namespace",
-        "label": "Namespace",
-        "skipUrlSync": false,
-        "query": "label_values(namespace:gpu_count:allocated, namespace)",
-        "datasource": {
-          "type": "prometheus",
-          "uid": "$ds_prometheus"
-        },
-        "current": {
-          "selected": true,
-          "text": "All",
-          "value": "$__all"
-        },
-        "multi": true,
-        "allowCustomValue": true,
-        "refresh": 2,
-        "sort": 1,
-        "includeAll": true,
-        "auto": false,
-        "auto_min": "10s",
-        "auto_count": 30
-      }
-    ]
-  },
-  "annotations": {}
-}
diff --git a/docs/agents/contributing.md b/docs/agents/contributing.md
index 88b062ea..658dab74 100644
--- a/docs/agents/contributing.md
+++ b/docs/agents/contributing.md
@@ -43,11 +43,10 @@ git commit --signoff -m "type(scope): brief description"
 
 **Types:** `feat`, `fix`, `docs`, `style`, `refactor`, `perf`, `test`, `build`, `ci`, `chore`
 
-**Scopes** (examples — not an exhaustive list; pick the most specific scope that describes the change, and introduce a new one if a genuinely new area needs its own):
-
-- System, e.g.: `dashboard`, `platform`, `operator`, `cilium`, `kube-ovn`, `linstor`, `fluxcd`, `cluster-api`
-- Apps, e.g.: `postgres`, `mariadb`, `redis`, `kafka`, `clickhouse`, `virtual-machine`, `kubernetes`
-- Other, e.g.: `api`, `hack`, `tests`, `ci`, `docs`, `agents`, `maintenance`
+**Scopes** (e.g., not exhaustive — use any scope that names the component you are touching):
+- System: `dashboard`, `platform`, `cilium`, `kube-ovn`, `linstor`, `fluxcd`, `cluster-api`
+- Apps: `postgres`, `mariadb`, `redis`, `kafka`, `clickhouse`, `virtual-machine`, `kubernetes`
+- Other: `api`, `hack`, `tests`, `ci`, `docs`, `agents`, `maintenance`
 
 Breaking changes: append `!` after type/scope (`feat(api)!: ...`) or add a `BREAKING CHANGE:` footer.
 
@@ -58,49 +57,6 @@ git commit --signoff -m "fix(postgres): update operator to version 1.2.3"
 git commit --signoff -m "docs(contributing): add installation guide"
 ```
 
-## PR Title Auto-Labeling
-
-`.github/workflows/pr-labeler.yaml` parses the PR title on `opened`, `edited`, `reopened`, and `synchronize` events and applies labels additively (never removes). The title is expected to follow Conventional Commits — same format as commit messages above.
-
-**Type → `kind/*`:**
-
-| type      | label              |
-| --------- | ------------------ |
-| feat      | kind/feature       |
-| fix       | kind/bug           |
-| docs      | kind/documentation |
-| chore     | kind/cleanup       |
-| refactor  | kind/cleanup       |
-| style, perf, test, build, ci, revert | (no kind label) |
-
-**Scope → `area/*`** (full mapping in `.github/workflows/pr-labeler.yaml`):
-
-| scope (examples) | label |
-| --- | --- |
-| agents, ai | area/ai |
-| api, cozystack-api | area/api |
-| build | area/build |
-| ci | area/ci |
-| dashboard | area/dashboard |
-| postgres, mariadb, redis, etcd, kafka, clickhouse, postgres-operator, mariadb-operator | area/database |
-| extra | area/extra |
-| kubernetes | area/kubernetes |
-| monitoring, vlogs, vmstack, grafana, workloadmonitor | area/monitoring |
-| ingress, gateway, vpn, metallb, cilium, kube-ovn, cozy-proxy, ... | area/networking |
-| platform, bundle, flux, fluxcd, cluster-api, talos, installer, cozyctl, cozystack-engine, cozy-lib | area/platform |
-| backport, release | area/release |
-| seaweedfs, bucket, linstor, velero, harbor, backups | area/storage |
-| tests, e2e | area/testing |
-| kubevirt, cdi, vmi, vm-import, virtual-machine, hami, gpu-operator | area/virtualization |
-
-**Special handling:**
-
-- `[Backport release-1.x]` prefix is stripped before parsing; `area/release` and `backport` labels are added.
-- Composite scope (`feat(platform, system, apps): ...`) — each comma-separated part is mapped independently.
-- `!` after type or `BREAKING CHANGE:` footer in the body → `kind/breaking-change`.
-- Unmapped scope or non-conventional title → `area/uncategorized` (signals the PR needs manual area selection).
-- Bracket-style fallback (`[scope] description`) maps `scope` → `area/*` but cannot infer `kind/*`.
-
 ### AI Agent Attribution
 
 When an AI agent authors or materially assists with a commit, add an `Assisted-By:` trailer naming the model:
diff --git a/docs/agents/overview.md b/docs/agents/overview.md
index ae0fd1c4..35798961 100644
--- a/docs/agents/overview.md
+++ b/docs/agents/overview.md
@@ -83,14 +83,6 @@ packages/<category>/<package-name>/
 - Reference PR numbers when available
 - Keep commits atomic and focused
 
-### PackageSource CRD upgrade policy
-
-Each component in a `PackageSource` may set `install.upgradeCRDs` to control how CRDs from the chart's `crds/` directory are handled on `HelmRelease` upgrades. Allowed values: `Skip` (default — helm-controller does not touch CRDs on upgrade), `Create` (create new CRDs only), `CreateReplace` (create new and overwrite existing).
-
-Set `upgradeCRDs: CreateReplace` for operators whose upstream regularly adds new CRDs between versions (etcd-operator, cnpg, kubevirt, kamaji). Without it, new CRDs from a chart bump do not land on existing clusters — only fresh installs get them.
-
-Do **not** set `CreateReplace` blindly: it overwrites every CRD in `crds/` and can cause silent data loss if upstream drops a field from a CRD that has live objects. Only enable it for operators whose schema evolution is additive-only. When in doubt, leave it unset and apply new CRDs manually.
-
 ### Documentation
 
 Documentation is organized as follows:
diff --git a/docs/changelogs/v1.3.1.md b/docs/changelogs/v1.3.1.md
deleted file mode 100644
index 0f149d0d..00000000
--- a/docs/changelogs/v1.3.1.md
+++ /dev/null
@@ -1,37 +0,0 @@
-<!--
-https://github.com/cozystack/cozystack/releases/tag/v1.3.1
--->
-
-# v1.3.1 (2026-04-28)
-
-Patch release covering a TenantNamespace IDOR fix in the API, a destructive `post-upgrade` hook removed from the etcd chart, kamaji controller stability, a `linstor-csi` bump that fixes live migration on Protocol-A/B DRBD resources, the missing `linstor-gui` build wiring, and a velero RBAC fix that unblocked installs on bundles without Velero.
-
-## Security
-
-* **fix(api): prevent IDOR in TenantNamespace Get and Watch handlers**: Two IDOR (Insecure Direct Object Reference) vulnerabilities allowed authenticated users to read TenantNamespace metadata they had no RoleBinding for. The `Get` and `Watch` handlers now go through a new `hasAccessToNamespace()` helper that lists RoleBindings scoped only to the target namespace (orders of magnitude faster than the previous all-cluster scan), returns `NotFound` instead of leaking existence on unauthorized access, and applies the same check on the `Watch` filter path. Includes regression tests for the unauthorized paths. ([**@IvanHunters**](https://github.com/IvanHunters) in #2471, backport #2524)
-
-## Features
-
-* **feat(linstor): bump linstor-csi to v1.10.6 with Protocol-C dual-attach fix**: Live migration of KubeVirt VMs on Protocol-A/B (async) DRBD volumes no longer fails with `Protocol C required`. `linstor-csi` v1.10.6 now installs a `Protocol=C` override on the resource-definition during dual-attach and reverts it on detach, so `replicated-async` StorageClasses and other Protocol-A/B resource groups support live migration without manual `drbdadm adjust` intervention. ([**@kvaps**](https://github.com/kvaps) in #2496, backport #2505)
-
-## Fixes
-
-* **fix(backups): move velero-configmap Role to velero chart**: The `backupstrategy-controller` (a default package) declared a Role/RoleBinding scoped to the `cozy-velero` namespace for managing `ResourceModifier` ConfigMaps. On bundles where Velero was not enabled, that namespace did not exist and the HelmRelease failed with `namespaces "cozy-velero" not found`, blocking installation. The Role/RoleBinding now lives in the velero chart, so it is created only when velero is actually deployed. ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in #2459, backport #2467)
-
-* **fix(etcd): remove destructive post-upgrade cert-regeneration hook**: The etcd chart ran a `post-upgrade` Helm hook on every upgrade that deleted etcd TLS Secrets (`etcd-ca-tls`, `etcd-peer-ca-tls`, `etcd-client-tls`, `etcd-peer-tls`, `etcd-server-tls`) and then deleted etcd pods, forcing cert-manager to re-issue the entire etcd CA chain. On clusters with Kamaji-managed tenant control planes this put every tenant `kube-apiserver` into CrashLoopBackOff until each DataStore was manually re-reconciled. The hook was a one-shot `2.6.0 → 2.6.1` migration that became a permanent footgun once chart versioning moved to `0.0.0+<git-hash>` (always `< 2.6.1` per semver) and after the underlying `rotationPolicy: Always` issue was fixed in `47d81f70`. The hook is now removed entirely. ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in #2462, backport #2511)
-
-* **fix(kamaji): increase memory limits and add startup probe**: The kamaji controller frequently entered CrashLoopBackOff due to OOMKills (exit 137) within ~20–25 seconds of startup, with the readiness probe failing while the controller was still finishing initialization. Memory limit raised from 500Mi to 512Mi, request from 100Mi to 256Mi, and a 60-second startup probe (12 attempts × 5s periods) is added so the controller has room to boot before liveness/readiness probes engage. ([**@IvanHunters**](https://github.com/IvanHunters) in #2421, backport #2491)
-
-## Build
-
-* **build(linstor): include linstor-gui in root image build target**: The `linstor-gui` package (added in #2382) was never wired into the root `Makefile`'s `build:` target, so CI never built or published the image. `ghcr.io/cozystack/cozystack/linstor-gui` returned `NAME_UNKNOWN` and `values.yaml` stayed pinned to `tag: 2.3.0` without a digest. The missing build line is added so the next CI run publishes the image and the per-package `Makefile` digest-pins `values.yaml` automatically. ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in #2498, backport #2518)
-
-## Contributors
-
-Thanks to everyone who contributed to this patch release:
-
-* [**@IvanHunters**](https://github.com/IvanHunters)
-* [**@kvaps**](https://github.com/kvaps)
-* [**@myasnikovdaniil**](https://github.com/myasnikovdaniil)
-
-**Full Changelog**: https://github.com/cozystack/cozystack/compare/v1.3.0...v1.3.1
diff --git a/go.mod b/go.mod
index 7b7d5bc4..9fd722e2 100644
--- a/go.mod
+++ b/go.mod
@@ -2,7 +2,7 @@
 
 module github.com/cozystack/cozystack
 
-go 1.25.0
+go 1.26.2
 
 require (
 	github.com/cozystack/cozystack-scheduler/pkg/apis v0.1.1
@@ -36,12 +36,12 @@ require (
 )
 
 require (
-	cel.dev/expr v0.24.0 // indirect
+	cel.dev/expr v0.25.1 // indirect
 	github.com/NYTimes/gziphandler v1.1.1 // indirect
 	github.com/antlr4-go/antlr/v4 v4.13.0 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/blang/semver/v4 v4.0.0 // indirect
-	github.com/cenkalti/backoff/v4 v4.3.0 // indirect
+	github.com/cenkalti/backoff/v5 v5.0.3 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
 	github.com/coreos/go-semver v0.3.1 // indirect
 	github.com/coreos/go-systemd/v22 v22.5.0 // indirect
@@ -69,13 +69,13 @@ require (
 	github.com/google/uuid v1.6.0 // indirect
 	github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674 // indirect
 	github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0 // indirect
-	github.com/grpc-ecosystem/grpc-gateway/v2 v2.26.3 // indirect
+	github.com/grpc-ecosystem/grpc-gateway/v2 v2.28.0 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/josharian/intern v1.0.0 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
 	github.com/kylelemons/godebug v1.1.0 // indirect
 	github.com/mailru/easyjson v0.9.0 // indirect
-	github.com/moby/spdystream v0.5.0 // indirect
+	github.com/moby/spdystream v0.5.1 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
 	github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
@@ -91,34 +91,34 @@ require (
 	go.etcd.io/etcd/api/v3 v3.6.4 // indirect
 	go.etcd.io/etcd/client/pkg/v3 v3.6.4 // indirect
 	go.etcd.io/etcd/client/v3 v3.6.4 // indirect
-	go.opentelemetry.io/auto/sdk v1.1.0 // indirect
-	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.61.0 // indirect
-	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0 // indirect
-	go.opentelemetry.io/otel v1.37.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.34.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.34.0 // indirect
-	go.opentelemetry.io/otel/metric v1.37.0 // indirect
-	go.opentelemetry.io/otel/sdk v1.37.0 // indirect
-	go.opentelemetry.io/otel/trace v1.37.0 // indirect
-	go.opentelemetry.io/proto/otlp v1.5.0 // indirect
+	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
+	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.68.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.68.0 // indirect
+	go.opentelemetry.io/otel v1.43.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.43.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.43.0 // indirect
+	go.opentelemetry.io/otel/metric v1.43.0 // indirect
+	go.opentelemetry.io/otel/sdk v1.43.0 // indirect
+	go.opentelemetry.io/otel/trace v1.43.0 // indirect
+	go.opentelemetry.io/proto/otlp v1.10.0 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
 	go.yaml.in/yaml/v2 v2.4.2 // indirect
 	go.yaml.in/yaml/v3 v3.0.4 // indirect
-	golang.org/x/crypto v0.42.0 // indirect
+	golang.org/x/crypto v0.50.0 // indirect
 	golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56 // indirect
-	golang.org/x/net v0.45.0 // indirect
-	golang.org/x/oauth2 v0.30.0 // indirect
-	golang.org/x/sync v0.17.0 // indirect
-	golang.org/x/sys v0.36.0 // indirect
-	golang.org/x/term v0.35.0 // indirect
-	golang.org/x/text v0.29.0 // indirect
+	golang.org/x/net v0.52.0 // indirect
+	golang.org/x/oauth2 v0.35.0 // indirect
+	golang.org/x/sync v0.20.0 // indirect
+	golang.org/x/sys v0.43.0 // indirect
+	golang.org/x/term v0.42.0 // indirect
+	golang.org/x/text v0.36.0 // indirect
 	golang.org/x/time v0.12.0 // indirect
-	golang.org/x/tools v0.37.0 // indirect
+	golang.org/x/tools v0.43.0 // indirect
 	gomodules.xyz/jsonpatch/v2 v2.4.0 // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20250603155806-513f23925822 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20250603155806-513f23925822 // indirect
-	google.golang.org/grpc v1.73.0 // indirect
-	google.golang.org/protobuf v1.36.6 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20260401024825-9d38bb4040a9 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20260406210006-6f92a3bedf2d // indirect
+	google.golang.org/grpc v1.80.0 // indirect
+	google.golang.org/protobuf v1.36.11 // indirect
 	gopkg.in/evanphx/json-patch.v4 v4.12.0 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/natefinch/lumberjack.v2 v2.2.1 // indirect
diff --git a/go.sum b/go.sum
index 81e1779f..8f0fee48 100644
--- a/go.sum
+++ b/go.sum
@@ -1,5 +1,5 @@
-cel.dev/expr v0.24.0 h1:56OvJKSH3hDGL0ml5uSxZmz3/3Pq4tJ+fb1unVLAFcY=
-cel.dev/expr v0.24.0/go.mod h1:hLPLo1W4QUmuYdA72RBX06QTs6MXw941piREPl3Yfiw=
+cel.dev/expr v0.25.1 h1:1KrZg61W6TWSxuNZ37Xy49ps13NUovb66QLprthtwi4=
+cel.dev/expr v0.25.1/go.mod h1:hrXvqGP6G6gyx8UAHSHJ5RGk//1Oj5nXQ2NI02Nrsg4=
 github.com/NYTimes/gziphandler v1.1.1 h1:ZUDjpQae29j0ryrS0u/B8HZfJBtBQHjqw2rQ2cqUQ3I=
 github.com/NYTimes/gziphandler v1.1.1/go.mod h1:n/CVRwUEOgIxrgPvAQhUUr9oeUtvrhMomdKFjzJNB0c=
 github.com/antlr4-go/antlr/v4 v4.13.0 h1:lxCg3LAv+EUK6t1i0y1V6/SLeUi0eKEKdhQAlS8TVTI=
@@ -10,8 +10,8 @@ github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
 github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
 github.com/blang/semver/v4 v4.0.0 h1:1PFHFE6yCCTv8C1TeyNNarDzntLi7wMI5i/pzqYIsAM=
 github.com/blang/semver/v4 v4.0.0/go.mod h1:IbckMUScFkM3pff0VJDNKRiT6TG/YpiHIM2yvyW5YoQ=
-github.com/cenkalti/backoff/v4 v4.3.0 h1:MyRJ/UdXutAwSAT+s3wNd7MfTIcy71VQueUuFK343L8=
-github.com/cenkalti/backoff/v4 v4.3.0/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE=
+github.com/cenkalti/backoff/v5 v5.0.3 h1:ZN+IMa753KfX5hd8vVaMixjnqRZ3y8CuJKRKj1xcsSM=
+github.com/cenkalti/backoff/v5 v5.0.3/go.mod h1:rkhZdG3JZukswDf7f0cwqPNk4K0sa+F97BxZthm/crw=
 github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
 github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
 github.com/coreos/go-semver v0.3.1 h1:yi21YpKnrx1gt5R+la8n5WgS0kCrsPp33dmEyHReZr4=
@@ -100,8 +100,8 @@ github.com/grpc-ecosystem/go-grpc-middleware/v2 v2.3.0 h1:FbSCl+KggFl+Ocym490i/E
 github.com/grpc-ecosystem/go-grpc-middleware/v2 v2.3.0/go.mod h1:qOchhhIlmRcqk/O9uCo/puJlyo07YINaIqdZfZG3Jkc=
 github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0 h1:Ovs26xHkKqVztRpIrF/92BcuyuQ/YW4NSIpoGtfXNho=
 github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0/go.mod h1:8NvIoxWQoOIhqOTXgfV/d3M/q6VIi02HzZEHgUlZvzk=
-github.com/grpc-ecosystem/grpc-gateway/v2 v2.26.3 h1:5ZPtiqj0JL5oKWmcsq4VMaAW5ukBEgSGXEN89zeH1Jo=
-github.com/grpc-ecosystem/grpc-gateway/v2 v2.26.3/go.mod h1:ndYquD05frm2vACXE1nsccT4oJzjhw2arTS2cpUD1PI=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.28.0 h1:HWRh5R2+9EifMyIHV7ZV+MIZqgz+PMpZ14Jynv3O2Zs=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.28.0/go.mod h1:JfhWUomR1baixubs02l85lZYYOm7LV6om4ceouMv45c=
 github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
 github.com/jonboulle/clockwork v0.5.0 h1:Hyh9A8u51kptdkR+cqRpT1EebBwTn1oK9YfGYbdFz6I=
@@ -122,8 +122,8 @@ github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0
 github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=
 github.com/mailru/easyjson v0.9.0 h1:PrnmzHw7262yW8sTBwxi1PdJA3Iw/EKBa8psRf7d9a4=
 github.com/mailru/easyjson v0.9.0/go.mod h1:1+xMtQp2MRNVL/V1bOzuP3aP8VNwRW55fQUto+XFtTU=
-github.com/moby/spdystream v0.5.0 h1:7r0J1Si3QO/kjRitvSLVVFUjxMEb/YLj6S9FF62JBCU=
-github.com/moby/spdystream v0.5.0/go.mod h1:xBAYlnt/ay+11ShkdFKNAG7LsyK/tmNBVvVOwrfMgdI=
+github.com/moby/spdystream v0.5.1 h1:9sNYeYZUcci9R6/w7KDaFWEWeV4LStVG78Mpyq/Zm/Y=
+github.com/moby/spdystream v0.5.1/go.mod h1:xBAYlnt/ay+11ShkdFKNAG7LsyK/tmNBVvVOwrfMgdI=
 github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
@@ -153,8 +153,8 @@ github.com/prometheus/procfs v0.15.1 h1:YagwOFzUgYfKKHX6Dr+sHT7km/hxC76UB0leargg
 github.com/prometheus/procfs v0.15.1/go.mod h1:fB45yRUv8NstnjriLhBQLuOUt+WW4BsoGhij/e3PBqk=
 github.com/robfig/cron/v3 v3.0.1 h1:WdRxkvbJztn8LMz/QEvLN5sBU+xKpSqwwUO1Pjr4qDs=
 github.com/robfig/cron/v3 v3.0.1/go.mod h1:eQICP3HwyT7UooqI/z+Ov+PtYAWygg1TEWWzGIFLtro=
-github.com/rogpeppe/go-internal v1.13.1 h1:KvO1DLK/DRN07sQ1LQKScxyZJuNnedQ5/wKSR38lUII=
-github.com/rogpeppe/go-internal v1.13.1/go.mod h1:uMEvuHeurkdAXX61udpOXGD/AzZDWNMNyH2VO9fmH0o=
+github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=
+github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
 github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
@@ -202,28 +202,28 @@ go.etcd.io/etcd/server/v3 v3.6.4 h1:LsCA7CzjVt+8WGrdsnh6RhC0XqCsLkBly3ve5rTxMAU=
 go.etcd.io/etcd/server/v3 v3.6.4/go.mod h1:aYCL/h43yiONOv0QIR82kH/2xZ7m+IWYjzRmyQfnCAg=
 go.etcd.io/raft/v3 v3.6.0 h1:5NtvbDVYpnfZWcIHgGRk9DyzkBIXOi8j+DDp1IcnUWQ=
 go.etcd.io/raft/v3 v3.6.0/go.mod h1:nLvLevg6+xrVtHUmVaTcTz603gQPHfh7kUAwV6YpfGo=
-go.opentelemetry.io/auto/sdk v1.1.0 h1:cH53jehLUN6UFLY71z+NDOiNJqDdPRaXzTel0sJySYA=
-go.opentelemetry.io/auto/sdk v1.1.0/go.mod h1:3wSPjt5PWp2RhlCcmmOial7AvC4DQqZb7a7wCow3W8A=
-go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.61.0 h1:q4XOmH/0opmeuJtPsbFNivyl7bCt7yRBbeEm2sC/XtQ=
-go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.61.0/go.mod h1:snMWehoOh2wsEwnvvwtDyFCxVeDAODenXHtn5vzrKjo=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0 h1:F7Jx+6hwnZ41NSFTO5q4LYDtJRXBf2PD0rNBkeB/lus=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0/go.mod h1:UHB22Z8QsdRDrnAtX4PntOl36ajSxcdUMt1sF7Y6E7Q=
-go.opentelemetry.io/otel v1.37.0 h1:9zhNfelUvx0KBfu/gb+ZgeAfAgtWrfHJZcAqFC228wQ=
-go.opentelemetry.io/otel v1.37.0/go.mod h1:ehE/umFRLnuLa/vSccNq9oS1ErUlkkK71gMcN34UG8I=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.34.0 h1:OeNbIYk/2C15ckl7glBlOBp5+WlYsOElzTNmiPW/x60=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.34.0/go.mod h1:7Bept48yIeqxP2OZ9/AqIpYS94h2or0aB4FypJTc8ZM=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.34.0 h1:tgJ0uaNS4c98WRNUEx5U3aDlrDOI5Rs+1Vifcw4DJ8U=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.34.0/go.mod h1:U7HYyW0zt/a9x5J1Kjs+r1f/d4ZHnYFclhYY2+YbeoE=
-go.opentelemetry.io/otel/metric v1.37.0 h1:mvwbQS5m0tbmqML4NqK+e3aDiO02vsf/WgbsdpcPoZE=
-go.opentelemetry.io/otel/metric v1.37.0/go.mod h1:04wGrZurHYKOc+RKeye86GwKiTb9FKm1WHtO+4EVr2E=
-go.opentelemetry.io/otel/sdk v1.37.0 h1:ItB0QUqnjesGRvNcmAcU0LyvkVyGJ2xftD29bWdDvKI=
-go.opentelemetry.io/otel/sdk v1.37.0/go.mod h1:VredYzxUvuo2q3WRcDnKDjbdvmO0sCzOvVAiY+yUkAg=
-go.opentelemetry.io/otel/sdk/metric v1.36.0 h1:r0ntwwGosWGaa0CrSt8cuNuTcccMXERFwHX4dThiPis=
-go.opentelemetry.io/otel/sdk/metric v1.36.0/go.mod h1:qTNOhFDfKRwX0yXOqJYegL5WRaW376QbB7P4Pb0qva4=
-go.opentelemetry.io/otel/trace v1.37.0 h1:HLdcFNbRQBE2imdSEgm/kwqmQj1Or1l/7bW6mxVK7z4=
-go.opentelemetry.io/otel/trace v1.37.0/go.mod h1:TlgrlQ+PtQO5XFerSPUYG0JSgGyryXewPGyayAWSBS0=
-go.opentelemetry.io/proto/otlp v1.5.0 h1:xJvq7gMzB31/d406fB8U5CBdyQGw4P399D1aQWU/3i4=
-go.opentelemetry.io/proto/otlp v1.5.0/go.mod h1:keN8WnHxOy8PG0rQZjJJ5A2ebUoafqWp0eVQ4yIXvJ4=
+go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=
+go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y=
+go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.68.0 h1:0Qx7VGBacMm9ZENQ7TnNObTYI4ShC+lHI16seduaxZo=
+go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.68.0/go.mod h1:Sje3i3MjSPKTSPvVWCaL8ugBzJwik3u4smCjUeuupqg=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.68.0 h1:CqXxU8VOmDefoh0+ztfGaymYbhdB/tT3zs79QaZTNGY=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.68.0/go.mod h1:BuhAPThV8PBHBvg8ZzZ/Ok3idOdhWIodywz2xEcRbJo=
+go.opentelemetry.io/otel v1.43.0 h1:mYIM03dnh5zfN7HautFE4ieIig9amkNANT+xcVxAj9I=
+go.opentelemetry.io/otel v1.43.0/go.mod h1:JuG+u74mvjvcm8vj8pI5XiHy1zDeoCS2LB1spIq7Ay0=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.43.0 h1:88Y4s2C8oTui1LGM6bTWkw0ICGcOLCAI5l6zsD1j20k=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.43.0/go.mod h1:Vl1/iaggsuRlrHf/hfPJPvVag77kKyvrLeD10kpMl+A=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.43.0 h1:RAE+JPfvEmvy+0LzyUA25/SGawPwIUbZ6u0Wug54sLc=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.43.0/go.mod h1:AGmbycVGEsRx9mXMZ75CsOyhSP6MFIcj/6dnG+vhVjk=
+go.opentelemetry.io/otel/metric v1.43.0 h1:d7638QeInOnuwOONPp4JAOGfbCEpYb+K6DVWvdxGzgM=
+go.opentelemetry.io/otel/metric v1.43.0/go.mod h1:RDnPtIxvqlgO8GRW18W6Z/4P462ldprJtfxHxyKd2PY=
+go.opentelemetry.io/otel/sdk v1.43.0 h1:pi5mE86i5rTeLXqoF/hhiBtUNcrAGHLKQdhg4h4V9Dg=
+go.opentelemetry.io/otel/sdk v1.43.0/go.mod h1:P+IkVU3iWukmiit/Yf9AWvpyRDlUeBaRg6Y+C58QHzg=
+go.opentelemetry.io/otel/sdk/metric v1.43.0 h1:S88dyqXjJkuBNLeMcVPRFXpRw2fuwdvfCGLEo89fDkw=
+go.opentelemetry.io/otel/sdk/metric v1.43.0/go.mod h1:C/RJtwSEJ5hzTiUz5pXF1kILHStzb9zFlIEe85bhj6A=
+go.opentelemetry.io/otel/trace v1.43.0 h1:BkNrHpup+4k4w+ZZ86CZoHHEkohws8AY+WTX09nk+3A=
+go.opentelemetry.io/otel/trace v1.43.0/go.mod h1:/QJhyVBUUswCphDVxq+8mld+AvhXZLhe+8WVFxiFff0=
+go.opentelemetry.io/proto/otlp v1.10.0 h1:IQRWgT5srOCYfiWnpqUYz9CVmbO8bFmKcwYxpuCSL2g=
+go.opentelemetry.io/proto/otlp v1.10.0/go.mod h1:/CV4QoCR/S9yaPj8utp3lvQPoqMtxXdzn7ozvvozVqk=
 go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
 go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
 go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=
@@ -237,8 +237,8 @@ go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/crypto v0.42.0 h1:chiH31gIWm57EkTXpwnqf8qeuMUi0yekh6mT2AvFlqI=
-golang.org/x/crypto v0.42.0/go.mod h1:4+rDnOTJhQCx2q7/j6rAN5XDw8kPjeaXEUR2eL94ix8=
+golang.org/x/crypto v0.50.0 h1:zO47/JPrL6vsNkINmLoo/PH1gcxpls50DNogFvB5ZGI=
+golang.org/x/crypto v0.50.0/go.mod h1:3muZ7vA7PBCE6xgPX7nkzzjiUq87kRItoJQM1Yo8S+Q=
 golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56 h1:2dVuKD2vS7b0QIHQbpyTISPd0LeHDbnYEryqj5Q1ug8=
 golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56/go.mod h1:M4RDyNAINzryxdtnbRXRL/OHtkFuWGRjvuhBJpk2IlY=
 golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
@@ -247,48 +247,50 @@ golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
-golang.org/x/net v0.45.0 h1:RLBg5JKixCy82FtLJpeNlVM0nrSqpCRYzVU1n8kj0tM=
-golang.org/x/net v0.45.0/go.mod h1:ECOoLqd5U3Lhyeyo/QDCEVQ4sNgYsqvCZ722XogGieY=
-golang.org/x/oauth2 v0.30.0 h1:dnDm7JmhM45NNpd8FDDeLhK6FwqbOf4MLCM9zb1BOHI=
-golang.org/x/oauth2 v0.30.0/go.mod h1:B++QgG3ZKulg6sRPGD/mqlHQs5rB3Ml9erfeDY7xKlU=
+golang.org/x/net v0.52.0 h1:He/TN1l0e4mmR3QqHMT2Xab3Aj3L9qjbhRm78/6jrW0=
+golang.org/x/net v0.52.0/go.mod h1:R1MAz7uMZxVMualyPXb+VaqGSa3LIaUqk0eEt3w36Sw=
+golang.org/x/oauth2 v0.35.0 h1:Mv2mzuHuZuY2+bkyWXIHMfhNdJAdwW3FuWeCPYN5GVQ=
+golang.org/x/oauth2 v0.35.0/go.mod h1:lzm5WQJQwKZ3nwavOZ3IS5Aulzxi68dUSgRHujetwEA=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.17.0 h1:l60nONMj9l5drqw6jlhIELNv9I0A4OFgRsG9k2oT9Ug=
-golang.org/x/sync v0.17.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
+golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4=
+golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.36.0 h1:KVRy2GtZBrk1cBYA7MKu5bEZFxQk4NIDV6RLVcC8o0k=
-golang.org/x/sys v0.36.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
-golang.org/x/term v0.35.0 h1:bZBVKBudEyhRcajGcNc3jIfWPqV4y/Kt2XcoigOWtDQ=
-golang.org/x/term v0.35.0/go.mod h1:TPGtkTLesOwf2DE8CgVYiZinHAOuy5AYUYT1lENIZnA=
+golang.org/x/sys v0.43.0 h1:Rlag2XtaFTxp19wS8MXlJwTvoh8ArU6ezoyFsMyCTNI=
+golang.org/x/sys v0.43.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/term v0.42.0 h1:UiKe+zDFmJobeJ5ggPwOshJIVt6/Ft0rcfrXZDLWAWY=
+golang.org/x/term v0.42.0/go.mod h1:Dq/D+snpsbazcBG5+F9Q1n2rXV8Ma+71xEjTRufARgY=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.29.0 h1:1neNs90w9YzJ9BocxfsQNHKuAT4pkghyXc4nhZ6sJvk=
-golang.org/x/text v0.29.0/go.mod h1:7MhJOA9CD2qZyOKYazxdYMF85OwPdEr9jTtBpO7ydH4=
+golang.org/x/text v0.36.0 h1:JfKh3XmcRPqZPKevfXVpI1wXPTqbkE5f7JA92a55Yxg=
+golang.org/x/text v0.36.0/go.mod h1:NIdBknypM8iqVmPiuco0Dh6P5Jcdk8lJL0CUebqK164=
 golang.org/x/time v0.12.0 h1:ScB/8o8olJvc+CQPWrK3fPZNfh7qgwCrY0zJmoEQLSE=
 golang.org/x/time v0.12.0/go.mod h1:CDIdPxbZBQxdj6cxyCIdrNogrJKMJ7pr37NYpMcMDSg=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
 golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.37.0 h1:DVSRzp7FwePZW356yEAChSdNcQo6Nsp+fex1SUW09lE=
-golang.org/x/tools v0.37.0/go.mod h1:MBN5QPQtLMHVdvsbtarmTNukZDdgwdwlO5qGacAzF0w=
+golang.org/x/tools v0.43.0 h1:12BdW9CeB3Z+J/I/wj34VMl8X+fEXBxVR90JeMX5E7s=
+golang.org/x/tools v0.43.0/go.mod h1:uHkMso649BX2cZK6+RpuIPXS3ho2hZo4FVwfoy1vIk0=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 gomodules.xyz/jsonpatch/v2 v2.4.0 h1:Ci3iUJyx9UeRx7CeFN8ARgGbkESwJK+KB9lLcWxY/Zw=
 gomodules.xyz/jsonpatch/v2 v2.4.0/go.mod h1:AH3dM2RI6uoBZxn3LVrfvJ3E0/9dG4cSrbuBJT4moAY=
-google.golang.org/genproto/googleapis/api v0.0.0-20250603155806-513f23925822 h1:oWVWY3NzT7KJppx2UKhKmzPq4SRe0LdCijVRwvGeikY=
-google.golang.org/genproto/googleapis/api v0.0.0-20250603155806-513f23925822/go.mod h1:h3c4v36UTKzUiuaOKQ6gr3S+0hovBtUrXzTG/i3+XEc=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20250603155806-513f23925822 h1:fc6jSaCT0vBduLYZHYrBBNY4dsWuvgyff9noRNDdBeE=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20250603155806-513f23925822/go.mod h1:qQ0YXyHHx3XkvlzUtpXDkS29lDSafHMZBAZDc03LQ3A=
-google.golang.org/grpc v1.73.0 h1:VIWSmpI2MegBtTuFt5/JWy2oXxtjJ/e89Z70ImfD2ok=
-google.golang.org/grpc v1.73.0/go.mod h1:50sbHOUqWoCQGI8V2HQLJM0B+LMlIUjNSZmow7EVBQc=
-google.golang.org/protobuf v1.36.6 h1:z1NpPI8ku2WgiWnf+t9wTPsn6eP1L7ksHUlkfLvd9xY=
-google.golang.org/protobuf v1.36.6/go.mod h1:jduwjTPXsFjZGTmRluh+L6NjiWu7pchiJ2/5YcXBHnY=
+gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4=
+gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E=
+google.golang.org/genproto/googleapis/api v0.0.0-20260401024825-9d38bb4040a9 h1:VPWxll4HlMw1Vs/qXtN7BvhZqsS9cdAittCNvVENElA=
+google.golang.org/genproto/googleapis/api v0.0.0-20260401024825-9d38bb4040a9/go.mod h1:7QBABkRtR8z+TEnmXTqIqwJLlzrZKVfAUm7tY3yGv0M=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260406210006-6f92a3bedf2d h1:wT2n40TBqFY6wiwazVK9/iTWbsQrgk5ZfCSVFLO9LQA=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260406210006-6f92a3bedf2d/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
+google.golang.org/grpc v1.80.0 h1:Xr6m2WmWZLETvUNvIUmeD5OAagMw3FiKmMlTdViWsHM=
+google.golang.org/grpc v1.80.0/go.mod h1:ho/dLnxwi3EDJA4Zghp7k2Ec1+c2jqup0bFkw07bwF4=
+google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
+google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
diff --git a/hack/admin-kubeconfig-invariant.bats b/hack/admin-kubeconfig-invariant.bats
deleted file mode 100644
index a4b98b00..00000000
--- a/hack/admin-kubeconfig-invariant.bats
+++ /dev/null
@@ -1,145 +0,0 @@
-#!/usr/bin/env bats
-# -----------------------------------------------------------------------------
-# Chart-wide invariant for packages/apps/kubernetes:
-#
-# Every Deployment in this chart that mounts <release>-admin-kubeconfig as a
-# Secret volume MUST:
-#   - declare that volume optional: true (so kubelet does not FailedMount
-#     while Kamaji is still provisioning the Secret), AND
-#   - include the wait-for-kubeconfig init container (so the pod becomes
-#     Ready only after Kamaji publishes the Secret).
-#
-# The per-template unittests in packages/apps/kubernetes/tests/ lock in
-# today's three Deployments (cluster-autoscaler, kccm, csi controller) by
-# name. This invariant is stricter: any future Deployment added to this
-# chart that mounts the same Secret but forgets the guard will fail here.
-#
-# Requires: helm, yq (mikefarah v4+), jq. All three are available on the
-# project's CI runners and on the maintainer workstation.
-# -----------------------------------------------------------------------------
-
-@test "every Deployment mounting admin-kubeconfig has optional:true and wait-for-kubeconfig init" {
-  values_file="packages/apps/kubernetes/tests/values-ci.yaml"
-  [ -f "$values_file" ]
-
-  tmp=$(mktemp -d)
-  trap 'rm -rf "$tmp"' EXIT
-
-  helm template invariant packages/apps/kubernetes \
-    --namespace tenant-root \
-    --values "$values_file" \
-    2>/dev/null > "$tmp/rendered.yaml"
-
-  # yq streams one JSON object per input document. jq -s slurps the stream
-  # into an array so we can treat all Deployments as a single collection.
-  yq --output-format=json eval-all '.' "$tmp/rendered.yaml" \
-    | jq -s --raw-output '
-        map(select(.kind == "Deployment")) |
-        map({
-          name: .metadata.name,
-          volumes: (.spec.template.spec.volumes // []),
-          initNames: ((.spec.template.spec.initContainers // []) | map(.name)),
-        }) |
-        map(
-          .name as $n |
-          .initNames as $ins |
-          (.volumes[] | select(.secret.secretName | test("-admin-kubeconfig$")?))
-          | {
-              name: $n,
-              optional: (.secret.optional == true),
-              hasInit: ($ins | index("wait-for-kubeconfig") != null),
-            }
-        )
-      ' > "$tmp/summary.json"
-
-  # At least one Deployment must match; if a refactor removes every
-  # admin-kubeconfig volume from this chart, the test must be updated
-  # deliberately rather than silently passing.
-  matched=$(jq 'length' "$tmp/summary.json")
-  [ "$matched" -ge 1 ]
-
-  offenders=$(jq --raw-output '.[] | select(.optional != true or .hasInit != true) | .name' "$tmp/summary.json")
-
-  if [ -n "$offenders" ]; then
-    echo "Deployments mounting *-admin-kubeconfig without optional:true + wait-for-kubeconfig init:" >&2
-    echo "$offenders" >&2
-    echo "Full summary:" >&2
-    cat "$tmp/summary.json" >&2
-    exit 1
-  fi
-
-  echo "Invariant holds for $matched Deployment(s)"
-}
-
-@test "chart emits zero admin-kubeconfig Deployments when tenant has no etcd DataStore" {
-  # Without a DataStore (parent Tenant has not populated _namespace.etcd yet)
-  # the control-plane-side Deployments must NOT render at all. If they did,
-  # the wait-for-kubeconfig init would CrashLoopBackOff indefinitely - there
-  # would be no KamajiControlPlane to provision the Secret - consuming the
-  # HelmRelease wait budget and triggering exactly the remediation cycle the
-  # rest of this chart tries to avoid. This test renders the whole chart
-  # with etcd empty and asserts no Deployment references the admin-kubeconfig
-  # Secret.
-  tmp=$(mktemp -d)
-  trap 'rm -rf "$tmp"' EXIT
-
-  helm template invariant packages/apps/kubernetes \
-    --namespace tenant-root \
-    --values packages/apps/kubernetes/tests/values-ci-no-etcd.yaml \
-    2>/dev/null > "$tmp/rendered.yaml"
-
-  matched=$(
-    yq --output-format=json eval-all '.' "$tmp/rendered.yaml" \
-      | jq -s '
-          map(select(.kind == "Deployment")) |
-          map(select(
-            (.spec.template.spec.volumes // [])
-              | any(.secret.secretName | test("-admin-kubeconfig$")?)
-          )) |
-          length
-        '
-  )
-
-  if [ "$matched" -ne 0 ]; then
-    echo "Expected zero Deployments mounting *-admin-kubeconfig when etcd is empty, got $matched:" >&2
-    yq --output-format=json eval-all '.' "$tmp/rendered.yaml" \
-      | jq -s 'map(select(.kind == "Deployment") | .metadata.name)' >&2
-    exit 1
-  fi
-
-  echo "No admin-kubeconfig Deployments rendered for empty etcd (as expected)"
-}
-
-@test "chart emits zero admin-kubeconfig HelmReleases when tenant has no etcd DataStore" {
-  # Same principle as the Deployment variant above, extended to every child
-  # HelmRelease (cilium, coredns, csi, cert-manager, ...). They reference
-  # *-admin-kubeconfig via kubeConfig.secretRef and would otherwise sit in
-  # NotReady forever on an etcd-less tenant, polluting the HelmRelease list
-  # the operator sees and contradicting the "awaiting-etcd beacon only"
-  # contract of the soft-skip path.
-  tmp=$(mktemp -d)
-  trap 'rm -rf "$tmp"' EXIT
-
-  helm template invariant packages/apps/kubernetes \
-    --namespace tenant-root \
-    --values packages/apps/kubernetes/tests/values-ci-no-etcd.yaml \
-    2>/dev/null > "$tmp/rendered.yaml"
-
-  matched=$(
-    yq --output-format=json eval-all '.' "$tmp/rendered.yaml" \
-      | jq -s '
-          map(select(.kind == "HelmRelease")) |
-          map(select(.spec.kubeConfig.secretRef.name | test("-admin-kubeconfig$")?)) |
-          length
-        '
-  )
-
-  if [ "$matched" -ne 0 ]; then
-    echo "Expected zero HelmReleases referencing *-admin-kubeconfig when etcd is empty, got $matched:" >&2
-    yq --output-format=json eval-all '.' "$tmp/rendered.yaml" \
-      | jq -s 'map(select(.kind == "HelmRelease") | .metadata.name)' >&2
-    exit 1
-  fi
-
-  echo "No admin-kubeconfig HelmReleases rendered for empty etcd (as expected)"
-}
diff --git a/hack/check-gpu-recording-rules.bats b/hack/check-gpu-recording-rules.bats
deleted file mode 100644
index bae6785e..00000000
--- a/hack/check-gpu-recording-rules.bats
+++ /dev/null
@@ -1,206 +0,0 @@
-#!/usr/bin/env bats
-# -----------------------------------------------------------------------------
-# Cross-validation between GPU recording rules, the dashboards that consume
-# them, and the DCGM Exporter metric set the cluster actually scrapes. Catches:
-#
-#   1. dangling references — a dashboard query mentions a recording rule name
-#      that doesn't exist in gpu-recording.rules.yaml. This is the bug the
-#      pre-merge review caught: gpu-efficiency.json shipped panels keyed on
-#      pod:tensor_saturation:avg5m without the rule being defined, so the
-#      panel showed "No data" everywhere.
-#
-#   2. typos in rule names — same bug class, manifested as a single-character
-#      difference between rule and reference.
-#
-#   3. undeclared DCGM metrics — a dashboard query or recording rule mentions
-#      a DCGM_FI_* metric that is neither in the upstream default CSV nor in
-#      the project's custom CSV (dcgm-custom-metrics.yaml), meaning DCGM
-#      Exporter would never emit it and the panel silently shows "No data".
-#      Example regression: gpu-fleet.json shipped a TDP panel referencing
-#      DCGM_FI_DEV_POWER_MGMT_LIMIT before the custom CSV declared it.
-#
-# Scope: only dashboards listed in packages/system/monitoring/dashboards-infra.list
-# under the "gpu/" prefix (i.e. shipped to production), not every JSON file in
-# dashboards/gpu/. Untracked drafts stay out of scope on purpose — adding one
-# to dashboards-infra.list is what brings it under the test.
-#
-# Reverse direction (rule defined but never consumed) is intentionally NOT
-# enforced: some rules exist for ad-hoc PromQL or upcoming dashboards. Treat
-# unused rules as an editorial concern, not a regression.
-#
-# Title syntax constraints from cozytest.sh's awk parser:
-#   - Titles delimited by ASCII double quotes; embedded quotes truncate.
-#   - Only [A-Za-z0-9] from the title survives into the function name; titles
-#     differing only in punctuation collapse to the same function.
-#
-# Run with: hack/cozytest.sh hack/check-gpu-recording-rules.bats
-# -----------------------------------------------------------------------------
-
-REPO_ROOT="$(cd "$(dirname "${BATS_TEST_FILENAME:-$0}")/.." && pwd)"
-RULES_FILE="$REPO_ROOT/packages/system/monitoring-agents/alerts/gpu-recording.rules.yaml"
-DASHBOARDS_LIST="$REPO_ROOT/packages/system/monitoring/dashboards-infra.list"
-DASHBOARDS_DIR="$REPO_ROOT/dashboards"
-DCGM_DEFAULT_CSV="$REPO_ROOT/hack/dcgm-default-counters.csv"
-DCGM_CUSTOM_CSV="$REPO_ROOT/packages/system/gpu-operator/examples/dcgm-custom-metrics.yaml"
-
-# Extract the set of "- record: NAME" entries from the rules YAML.
-# Outputs one rule name per line, sorted and deduplicated.
-extract_rules() {
-  awk '/^[[:space:]]*-[[:space:]]*record:[[:space:]]/ {
-    sub(/^[[:space:]]*-[[:space:]]*record:[[:space:]]*/, "")
-    sub(/[[:space:]]*$/, "")
-    print
-  }' "$RULES_FILE" | sort -u
-}
-
-# Extract the set of recording-rule references from a dashboard JSON.
-# A recording-rule reference is matched by the pattern
-#   <segment>:<segment>(:<segment>)+
-# where each <segment> is [a-z0-9_]. Raw DCGM metrics (DCGM_FI_*),
-# kube-state-metrics (kube_*) and similar uppercase / single-word metric
-# names do not match because the leading segment must be lowercase and the
-# whole expression must contain at least two ':' characters.
-extract_refs() {
-  json_file=$1
-  # Prometheus convention allows 2-segment rule names (level:metric); this
-  # regex is tuned to the 3+ segment convention used in this repo
-  # (level:metric:op — e.g. cluster:gpu_count:total). Update if future
-  # rules use 2 segments, otherwise they will be silently skipped.
-  grep -hoE '[a-z][a-z0-9_]*:[a-z0-9_]+:[a-z0-9_]+' "$json_file" | sort -u
-}
-
-# Resolve "gpu/foo" -> "$DASHBOARDS_DIR/gpu/foo.json"
-list_tracked_gpu_dashboards() {
-  awk '/^gpu\// { print $0 ".json" }' "$DASHBOARDS_LIST"
-}
-
-# Extract the set of DCGM_FI_* metric names declared in a CSV file. Handles
-# both the upstream-style default CSV (unindented) and the ConfigMap-style
-# custom CSV (YAML-indented). A declaration line starts — after any leading
-# whitespace — with "DCGM_FI_<NAME>," ; comment lines begin with "#" and are
-# skipped. Uses POSIX awk's match()+RSTART/RLENGTH so no GNU extensions
-# are required.
-extract_csv_metrics() {
-  file=$1
-  awk '
-    {
-      line = $0
-      sub(/^[[:space:]]+/, "", line)
-      if (line ~ /^#/) next
-      if (match(line, /^DCGM_FI_[A-Z0-9_]+/)) {
-        print substr(line, RSTART, RLENGTH)
-      }
-    }
-  ' "$file" | sort -u
-}
-
-# Extract the set of DCGM_FI_* metric references from a text file (dashboard
-# JSON or rules YAML). A DCGM metric name has at least two underscore-delimited
-# segments after the "DCGM_FI_" prefix (e.g. DCGM_FI_DEV_GPU_UTIL, DCGM_FI_PROF_
-# PIPE_TENSOR_ACTIVE, DCGM_FI_DRIVER_VERSION). Requiring two segments keeps
-# the matcher from latching onto glob stubs like "DCGM_FI_DEV_*_VIOLATION" that
-# appear in comments.
-extract_dcgm_refs() {
-  file=$1
-  grep -hoE 'DCGM_FI_[A-Z0-9]+(_[A-Z0-9]+)+' "$file" | sort -u
-}
-
-@test "every recording rule reference in tracked GPU dashboards has a matching record" {
-  TMP=$(mktemp -d)
-  trap 'rm -rf "$TMP"' EXIT
-
-  extract_rules > "$TMP/rules.txt"
-  [ -s "$TMP/rules.txt" ] || { echo "no recording rules extracted from $RULES_FILE" >&2; exit 1; }
-
-  list_tracked_gpu_dashboards > "$TMP/dashboards.txt"
-  [ -s "$TMP/dashboards.txt" ] || { echo "no gpu/* dashboards listed in $DASHBOARDS_LIST" >&2; exit 1; }
-
-  failed=0
-  while IFS= read -r dashboard_rel; do
-    dashboard="$DASHBOARDS_DIR/$dashboard_rel"
-    if [ ! -f "$dashboard" ]; then
-      echo "ERROR: dashboard listed but file missing: $dashboard" >&2
-      failed=1
-      continue
-    fi
-
-    extract_refs "$dashboard" > "$TMP/refs.txt"
-    # comm -23: lines unique to refs.txt (referenced but not defined)
-    # Both inputs must be sorted; extract_* helpers already sort.
-    comm -23 "$TMP/refs.txt" "$TMP/rules.txt" > "$TMP/missing.txt"
-    if [ -s "$TMP/missing.txt" ]; then
-      echo "ERROR: $dashboard_rel references undefined recording rules:" >&2
-      sed 's/^/  - /' "$TMP/missing.txt" >&2
-      failed=1
-    fi
-  done < "$TMP/dashboards.txt"
-
-  [ "$failed" -eq 0 ]
-}
-
-@test "every DCGM metric referenced in tracked dashboards and rules is declared" {
-  TMP=$(mktemp -d)
-  trap 'rm -rf "$TMP"' EXIT
-
-  [ -f "$DCGM_DEFAULT_CSV" ] || { echo "missing $DCGM_DEFAULT_CSV" >&2; exit 1; }
-  [ -f "$DCGM_CUSTOM_CSV" ]  || { echo "missing $DCGM_CUSTOM_CSV"  >&2; exit 1; }
-
-  {
-    extract_csv_metrics "$DCGM_DEFAULT_CSV"
-    extract_csv_metrics "$DCGM_CUSTOM_CSV"
-  } | sort -u > "$TMP/declared.txt"
-  [ -s "$TMP/declared.txt" ] || { echo "no DCGM metrics extracted from CSVs" >&2; exit 1; }
-
-  list_tracked_gpu_dashboards > "$TMP/dashboards.txt"
-  [ -s "$TMP/dashboards.txt" ] || { echo "no gpu/* dashboards listed in $DASHBOARDS_LIST" >&2; exit 1; }
-
-  failed=0
-
-  # Dashboard coverage — every dashboard's DCGM references must resolve.
-  while IFS= read -r dashboard_rel; do
-    dashboard="$DASHBOARDS_DIR/$dashboard_rel"
-    [ -f "$dashboard" ] || continue  # handled by the existence test
-    extract_dcgm_refs "$dashboard" > "$TMP/refs.txt"
-    [ -s "$TMP/refs.txt" ] || continue  # dashboard relies entirely on recording rules
-    comm -23 "$TMP/refs.txt" "$TMP/declared.txt" > "$TMP/missing.txt"
-    if [ -s "$TMP/missing.txt" ]; then
-      echo "ERROR: $dashboard_rel references DCGM metrics not declared in any CSV:" >&2
-      sed 's/^/  - /' "$TMP/missing.txt" >&2
-      failed=1
-    fi
-  done < "$TMP/dashboards.txt"
-
-  # Rules coverage — recording rules consume DCGM directly, so their set
-  # must be declared too, otherwise derived series on every dashboard
-  # collapse to empty.
-  extract_dcgm_refs "$RULES_FILE" > "$TMP/rule-refs.txt"
-  if [ -s "$TMP/rule-refs.txt" ]; then
-    comm -23 "$TMP/rule-refs.txt" "$TMP/declared.txt" > "$TMP/rule-missing.txt"
-    if [ -s "$TMP/rule-missing.txt" ]; then
-      echo "ERROR: gpu-recording.rules.yaml references DCGM metrics not declared in any CSV:" >&2
-      sed 's/^/  - /' "$TMP/rule-missing.txt" >&2
-      failed=1
-    fi
-  fi
-
-  [ "$failed" -eq 0 ]
-}
-
-@test "every tracked GPU dashboard listed in dashboards-infra.list exists on disk" {
-  TMP=$(mktemp -d)
-  trap 'rm -rf "$TMP"' EXIT
-
-  list_tracked_gpu_dashboards > "$TMP/dashboards.txt"
-  [ -s "$TMP/dashboards.txt" ] || { echo "no gpu/* dashboards listed in $DASHBOARDS_LIST" >&2; exit 1; }
-
-  failed=0
-  while IFS= read -r dashboard_rel; do
-    dashboard="$DASHBOARDS_DIR/$dashboard_rel"
-    if [ ! -f "$dashboard" ]; then
-      echo "ERROR: $dashboard_rel listed in dashboards-infra.list but $dashboard does not exist" >&2
-      failed=1
-    fi
-  done < "$TMP/dashboards.txt"
-
-  [ "$failed" -eq 0 ]
-}
diff --git a/hack/dcgm-default-counters.csv b/hack/dcgm-default-counters.csv
deleted file mode 100644
index b5e94540..00000000
--- a/hack/dcgm-default-counters.csv
+++ /dev/null
@@ -1,104 +0,0 @@
-# Snapshot of the upstream DCGM Exporter default-counters.csv used as a
-# fixture by hack/check-gpu-recording-rules.bats. The test verifies that
-# every DCGM_FI_* metric referenced by a tracked GPU dashboard is either
-# declared here (upstream defaults) or in
-# packages/system/gpu-operator/examples/dcgm-custom-metrics.yaml
-# (the project's custom CSV).
-#
-# Source: https://github.com/NVIDIA/dcgm-exporter/blob/4.1.1-4.0.4/etc/default-counters.csv
-# Pinned to the DCGM Exporter image tag shipped by the gpu-operator
-# chart under packages/system/gpu-operator/charts/gpu-operator/values.yaml
-# (dcgmExporter.version = 4.1.1-4.0.4-ubuntu22.04). When that image is
-# bumped, refresh this file from the matching tag in the NVIDIA/dcgm-exporter
-# repo and re-run `./hack/cozytest.sh hack/check-gpu-recording-rules.bats`.
-
-# Format
-# If line starts with a '#' it is considered a comment
-# DCGM FIELD, Prometheus metric type, help message
-
-# Clocks
-DCGM_FI_DEV_SM_CLOCK,  gauge, SM clock frequency (in MHz).
-DCGM_FI_DEV_MEM_CLOCK, gauge, Memory clock frequency (in MHz).
-
-# Temperature
-DCGM_FI_DEV_MEMORY_TEMP, gauge, Memory temperature (in C).
-DCGM_FI_DEV_GPU_TEMP,    gauge, GPU temperature (in C).
-
-# Power
-DCGM_FI_DEV_POWER_USAGE,              gauge, Power draw (in W).
-DCGM_FI_DEV_TOTAL_ENERGY_CONSUMPTION, counter, Total energy consumption since boot (in mJ).
-
-# PCIE
-# DCGM_FI_PROF_PCIE_TX_BYTES,  counter, Total number of bytes transmitted through PCIe TX via NVML.
-# DCGM_FI_PROF_PCIE_RX_BYTES,  counter, Total number of bytes received through PCIe RX via NVML.
-DCGM_FI_DEV_PCIE_REPLAY_COUNTER, counter, Total number of PCIe retries.
-
-# Utilization (the sample period varies depending on the product)
-DCGM_FI_DEV_GPU_UTIL,      gauge, GPU utilization (in %).
-DCGM_FI_DEV_MEM_COPY_UTIL, gauge, Memory utilization (in %).
-DCGM_FI_DEV_ENC_UTIL,      gauge, Encoder utilization (in %).
-DCGM_FI_DEV_DEC_UTIL ,     gauge, Decoder utilization (in %).
-
-# Errors and violations
-DCGM_FI_DEV_XID_ERRORS,              gauge,   Value of the last XID error encountered.
-# DCGM_FI_DEV_POWER_VIOLATION,       counter, Throttling duration due to power constraints (in us).
-# DCGM_FI_DEV_THERMAL_VIOLATION,     counter, Throttling duration due to thermal constraints (in us).
-# DCGM_FI_DEV_SYNC_BOOST_VIOLATION,  counter, Throttling duration due to sync-boost constraints (in us).
-# DCGM_FI_DEV_BOARD_LIMIT_VIOLATION, counter, Throttling duration due to board limit constraints (in us).
-# DCGM_FI_DEV_LOW_UTIL_VIOLATION,    counter, Throttling duration due to low utilization (in us).
-# DCGM_FI_DEV_RELIABILITY_VIOLATION, counter, Throttling duration due to reliability constraints (in us).
-
-# Memory usage
-DCGM_FI_DEV_FB_FREE, gauge, Framebuffer memory free (in MiB).
-DCGM_FI_DEV_FB_USED, gauge, Framebuffer memory used (in MiB).
-
-# ECC
-# DCGM_FI_DEV_ECC_SBE_VOL_TOTAL, counter, Total number of single-bit volatile ECC errors.
-# DCGM_FI_DEV_ECC_DBE_VOL_TOTAL, counter, Total number of double-bit volatile ECC errors.
-# DCGM_FI_DEV_ECC_SBE_AGG_TOTAL, counter, Total number of single-bit persistent ECC errors.
-# DCGM_FI_DEV_ECC_DBE_AGG_TOTAL, counter, Total number of double-bit persistent ECC errors.
-
-# Retired pages
-# DCGM_FI_DEV_RETIRED_SBE,     counter, Total number of retired pages due to single-bit errors.
-# DCGM_FI_DEV_RETIRED_DBE,     counter, Total number of retired pages due to double-bit errors.
-# DCGM_FI_DEV_RETIRED_PENDING, counter, Total number of pages pending retirement.
-
-# NVLink
-# DCGM_FI_DEV_NVLINK_CRC_FLIT_ERROR_COUNT_TOTAL, counter, Total number of NVLink flow-control CRC errors.
-# DCGM_FI_DEV_NVLINK_CRC_DATA_ERROR_COUNT_TOTAL, counter, Total number of NVLink data CRC errors.
-# DCGM_FI_DEV_NVLINK_REPLAY_ERROR_COUNT_TOTAL,   counter, Total number of NVLink retries.
-# DCGM_FI_DEV_NVLINK_RECOVERY_ERROR_COUNT_TOTAL, counter, Total number of NVLink recovery errors.
-DCGM_FI_DEV_NVLINK_BANDWIDTH_TOTAL,            counter, Total number of NVLink bandwidth counters for all lanes.
-# DCGM_FI_DEV_NVLINK_BANDWIDTH_L0,               counter, The number of bytes of active NVLink rx or tx data including both header and payload.
-
-# VGPU License status
-DCGM_FI_DEV_VGPU_LICENSE_STATUS, gauge, vGPU License status
-
-# Remapped rows
-DCGM_FI_DEV_UNCORRECTABLE_REMAPPED_ROWS, counter, Number of remapped rows for uncorrectable errors
-DCGM_FI_DEV_CORRECTABLE_REMAPPED_ROWS,   counter, Number of remapped rows for correctable errors
-DCGM_FI_DEV_ROW_REMAP_FAILURE,           gauge,   Whether remapping of rows has failed
-
-# Static configuration information. These appear as labels on the other metrics
-DCGM_FI_DRIVER_VERSION,        label, Driver Version
-# DCGM_FI_NVML_VERSION,          label, NVML Version
-# DCGM_FI_DEV_BRAND,             label, Device Brand
-# DCGM_FI_DEV_SERIAL,            label, Device Serial Number
-# DCGM_FI_DEV_OEM_INFOROM_VER,   label, OEM inforom version
-# DCGM_FI_DEV_ECC_INFOROM_VER,   label, ECC inforom version
-# DCGM_FI_DEV_POWER_INFOROM_VER, label, Power management object inforom version
-# DCGM_FI_DEV_INFOROM_IMAGE_VER, label, Inforom image version
-# DCGM_FI_DEV_VBIOS_VERSION,     label, VBIOS version of the device
-
-# Datacenter Profiling (DCP) metrics
-# NOTE: supported on Nvidia datacenter Volta GPUs and newer
-DCGM_FI_PROF_GR_ENGINE_ACTIVE,   gauge, Ratio of time the graphics engine is active.
-# DCGM_FI_PROF_SM_ACTIVE,          gauge, The ratio of cycles an SM has at least 1 warp assigned.
-# DCGM_FI_PROF_SM_OCCUPANCY,       gauge, The ratio of number of warps resident on an SM.
-DCGM_FI_PROF_PIPE_TENSOR_ACTIVE, gauge, Ratio of cycles the tensor (HMMA) pipe is active.
-DCGM_FI_PROF_DRAM_ACTIVE,        gauge, Ratio of cycles the device memory interface is active sending or receiving data.
-# DCGM_FI_PROF_PIPE_FP64_ACTIVE,   gauge, Ratio of cycles the fp64 pipes are active.
-# DCGM_FI_PROF_PIPE_FP32_ACTIVE,   gauge, Ratio of cycles the fp32 pipes are active.
-# DCGM_FI_PROF_PIPE_FP16_ACTIVE,   gauge, Ratio of cycles the fp16 pipes are active.
-DCGM_FI_PROF_PCIE_TX_BYTES,      gauge, The rate of data transmitted over the PCIe bus - including both protocol headers and data payloads - in bytes per second.
-DCGM_FI_PROF_PCIE_RX_BYTES,      gauge, The rate of data received over the PCIe bus - including both protocol headers and data payloads - in bytes per second.
diff --git a/hack/e2e-apps/remediation-guard.sh b/hack/e2e-apps/remediation-guard.sh
deleted file mode 100644
index b45561b9..00000000
--- a/hack/e2e-apps/remediation-guard.sh
+++ /dev/null
@@ -1,39 +0,0 @@
-# Helpers for asserting that a Flux HelmRelease did not fall into an
-# install/upgrade remediation cycle during an e2e run.
-#
-# Background: Flux helm-controller's ClearFailures() zeroes
-# .status.installFailures / .status.upgradeFailures on every successful
-# reconciliation (see the upstream ClearFailures method on
-# HelmReleaseStatus). That makes those counters useless for a guard that
-# runs after the HelmRelease has reached Ready - the values are always 0.
-#
-# What survives a successful reconciliation is .status.history, a bounded
-# list of release Snapshots. Each Snapshot carries a status field that
-# tracks the Helm release state: deployed, superseded, failed, uninstalled,
-# and so on. A remediation cycle leaves the footprint behind: a snapshot
-# with status "uninstalled" (from install/upgrade remediation) or "failed"
-# (Helm release failure that remediation then uninstalled). Those stay in
-# history even after a subsequent successful reinstall.
-#
-# helmrelease_has_remediation_cycle takes a newline-delimited list of
-# snapshot statuses (whatever the caller extracted via kubectl -o jsonpath
-# or equivalent) and returns 0 (detected) when any entry is "failed" or
-# "uninstalled", 1 otherwise. Empty input is treated as "no history yet,
-# no cycle observed".
-
-helmrelease_has_remediation_cycle() {
-    statuses="$1"
-    if [ -z "${statuses}" ]; then
-        return 1
-    fi
-    # printf + grep over the pipe, rather than a heredoc plus while read.
-    # printf %s treats the status string as a literal payload, so any stray
-    # $ in a future caller's input does not trigger shell expansion. grep
-    # returns 0 iff at least one line matches the allowlist, which is
-    # exactly the contract the caller wants, so we can return its exit
-    # status directly.
-    if printf '%s\n' "${statuses}" | grep --extended-regexp --quiet '^(failed|uninstalled)$'; then
-        return 0
-    fi
-    return 1
-}
diff --git a/hack/e2e-apps/run-kubernetes.sh b/hack/e2e-apps/run-kubernetes.sh
index 761ee57d..be6dcd6f 100644
--- a/hack/e2e-apps/run-kubernetes.sh
+++ b/hack/e2e-apps/run-kubernetes.sh
@@ -1,5 +1,3 @@
-. hack/e2e-apps/remediation-guard.sh
-
 run_kubernetes_test() {
     local version_expr="$1"
     local test_name="$2"
@@ -322,35 +320,6 @@ EOF
     done
     kubectl wait hr kubernetes-${test_name}-ingress-nginx -n tenant-test --timeout=5m --for=condition=ready
 
-  # Guard: parent HelmRelease must not have entered an install/upgrade remediation cycle.
-  # A non-zero installFailures/upgradeFailures indicates the helm-wait budget expired while
-  # admin-kubeconfig was still being provisioned, which would trigger uninstall remediation
-  # and churn the Cluster CR.
-  # Flux helm-controller v2 retains per-revision release Snapshots in
-  # .status.history; each Snapshot's .status reflects the Helm release
-  # state (deployed/superseded/failed/uninstalled). A remediation cycle
-  # leaves a "failed" or "uninstalled" entry behind that survives a later
-  # successful reinstall, unlike the installFailures/upgradeFailures
-  # counters (which ClearFailures zeroes on every successful reconcile).
-  # The shape is pinned by hack/remediation-guard.bats; the upstream
-  # types are github.com/fluxcd/helm-controller/api v2 Snapshot.
-  history_statuses=$(kubectl get hr -n tenant-test "kubernetes-${test_name}" \
-    -ojsonpath='{range .status.history[*]}{.status}{"\n"}{end}')
-  # Always emit the raw value so a silent future-Flux field rename shows
-  # up as "empty history on a Ready HR" in CI logs rather than vanishing.
-  echo "Parent HelmRelease history statuses:"
-  printf '%s\n' "${history_statuses:-<empty>}"
-  if [ -z "${history_statuses}" ]; then
-    echo "Unexpected empty .status.history on a Ready HelmRelease - Flux API shape may have changed." >&2
-    kubectl -n tenant-test describe hr "kubernetes-${test_name}" >&2
-    exit 1
-  fi
-  if helmrelease_has_remediation_cycle "${history_statuses}"; then
-    echo "Parent HelmRelease entered remediation cycle." >&2
-    kubectl -n tenant-test describe hr "kubernetes-${test_name}" >&2
-    exit 1
-  fi
-
   # Clean up
   pkill -f "port-forward.*${port}:" 2>/dev/null || true
   rm -f "tenantkubeconfig-${test_name}"
diff --git a/hack/remediation-guard.bats b/hack/remediation-guard.bats
deleted file mode 100644
index 092fe06d..00000000
--- a/hack/remediation-guard.bats
+++ /dev/null
@@ -1,127 +0,0 @@
-#!/usr/bin/env bats
-# -----------------------------------------------------------------------------
-# Unit tests for hack/e2e-apps/remediation-guard.sh
-#
-# helmrelease_has_remediation_cycle takes a newline-delimited list of
-# HelmRelease history snapshot status values (deployed/superseded/failed/
-# uninstalled/...) and returns 0 when any entry is "failed" or "uninstalled"
-# (meaning flux helm-controller performed install/upgrade remediation).
-#
-# This is used by the e2e script after the HelmRelease reaches Ready. The
-# failure/upgrade counters (.status.installFailures / .status.upgradeFailures)
-# are useless there because flux's ClearFailures zeroes them on successful
-# reconciliation; .status.history retains the snapshot trail.
-#
-# cozytest.sh's awk parser recognizes only @test blocks and a bare `}` on
-# its own line; there is no bats `run` or `$status`. Assertions are
-# expressed as direct shell tests that exit non-zero on failure.
-#
-# Run with: hack/cozytest.sh hack/remediation-guard.bats
-# -----------------------------------------------------------------------------
-
-@test "empty history returns not-detected" {
-    . hack/e2e-apps/remediation-guard.sh
-    if helmrelease_has_remediation_cycle ""; then
-        echo "expected not-detected for empty history" >&2
-        exit 1
-    fi
-}
-
-@test "single deployed snapshot returns not-detected" {
-    . hack/e2e-apps/remediation-guard.sh
-    if helmrelease_has_remediation_cycle "deployed"; then
-        echo "expected not-detected for deployed-only history" >&2
-        exit 1
-    fi
-}
-
-@test "deployed then superseded returns not-detected" {
-    . hack/e2e-apps/remediation-guard.sh
-    statuses=$(printf 'deployed\nsuperseded\n')
-    if helmrelease_has_remediation_cycle "${statuses}"; then
-        echo "expected not-detected for deployed+superseded history" >&2
-        exit 1
-    fi
-}
-
-@test "single failed snapshot returns detected" {
-    . hack/e2e-apps/remediation-guard.sh
-    if ! helmrelease_has_remediation_cycle "failed"; then
-        echo "expected detected when history contains failed snapshot" >&2
-        exit 1
-    fi
-}
-
-@test "single uninstalled snapshot returns detected" {
-    # The exact signature of the install-remediation race: the first install
-    # exceeded flux's wait budget, remediation uninstalled, the next retry
-    # eventually succeeded. History still carries the uninstalled snapshot.
-    . hack/e2e-apps/remediation-guard.sh
-    if ! helmrelease_has_remediation_cycle "uninstalled"; then
-        echo "expected detected when history contains uninstalled snapshot" >&2
-        exit 1
-    fi
-}
-
-@test "uninstalled then deployed still returns detected" {
-    . hack/e2e-apps/remediation-guard.sh
-    statuses=$(printf 'uninstalled\ndeployed\n')
-    if ! helmrelease_has_remediation_cycle "${statuses}"; then
-        echo "expected detected despite later successful deploy" >&2
-        exit 1
-    fi
-}
-
-@test "deployed then failed still returns detected" {
-    . hack/e2e-apps/remediation-guard.sh
-    statuses=$(printf 'deployed\nfailed\n')
-    if ! helmrelease_has_remediation_cycle "${statuses}"; then
-        echo "expected detected when any entry is failed" >&2
-        exit 1
-    fi
-}
-
-@test "status.history extraction pins HR v2 status.history shape" {
-    # Pins the Flux HelmRelease v2 .status.history[].status shape that
-    # run-kubernetes.sh relies on. If a future flux release renames the
-    # field, the jsonpath returns nothing, the guard reports no cycle,
-    # and real remediation loops slip past the e2e assertion. This test
-    # uses yq to read the exact path used in the e2e script; the upstream
-    # Snapshot type lives at
-    # github.com/fluxcd/helm-controller/api/v2.Snapshot (via go.mod).
-    tmp=$(mktemp -d)
-    trap 'rm -rf "$tmp"' EXIT
-
-    cat > "$tmp/hr.yaml" <<'YAML'
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: kubernetes-test
-  namespace: tenant-test
-status:
-  history:
-    - name: kubernetes-test
-      namespace: tenant-test
-      version: 1
-      status: uninstalled
-    - name: kubernetes-test
-      namespace: tenant-test
-      version: 2
-      status: deployed
-YAML
-
-    # Default yq output is yaml scalar format, which for string values emits
-    # bare unquoted tokens - matching what kubectl -o jsonpath produces in
-    # e2e. Do not switch to JSON output here; that would quote the values
-    # and break the loop in helmrelease_has_remediation_cycle.
-    statuses=$(yq '.status.history[].status' "$tmp/hr.yaml")
-
-    [ -n "$statuses" ]
-    echo "$statuses" | grep --quiet '^uninstalled$'
-
-    . hack/e2e-apps/remediation-guard.sh
-    if ! helmrelease_has_remediation_cycle "$statuses"; then
-        echo "expected detected for pinned HR snippet with uninstalled + deployed history" >&2
-        exit 1
-    fi
-}
diff --git a/internal/crdinstall/manifests/cozystack.io_packagesources.yaml b/internal/crdinstall/manifests/cozystack.io_packagesources.yaml
index 1d0037df..0acfcdd2 100644
--- a/internal/crdinstall/manifests/cozystack.io_packagesources.yaml
+++ b/internal/crdinstall/manifests/cozystack.io_packagesources.yaml
@@ -118,19 +118,6 @@ spec:
                                   ReleaseName is the name of the HelmRelease resource that will be created
                                   If not specified, defaults to the component Name field
                                 type: string
-                              upgradeCRDs:
-                                description: |-
-                                  UpgradeCRDs controls how CRDs from the chart's crds/ directory are
-                                  handled on HelmRelease upgrades. Maps to HelmRelease.Spec.Upgrade.CRDs.
-                                  Empty string (default) preserves the helm-controller default (Skip).
-                                  Use "CreateReplace" for operators that evolve their CRD set between
-                                  versions. Warning: CreateReplace overwrites CRDs and may cause data
-                                  loss if upstream drops fields from a CRD with live objects.
-                                enum:
-                                - Skip
-                                - Create
-                                - CreateReplace
-                                type: string
                             type: object
                           libraries:
                             description: |-
diff --git a/internal/operator/package_reconciler.go b/internal/operator/package_reconciler.go
index 0e724e49..32e667e4 100644
--- a/internal/operator/package_reconciler.go
+++ b/internal/operator/package_reconciler.go
@@ -45,16 +45,6 @@ const (
 	SecretCozystackValues = "cozystack-values"
 )
 
-// parseCRDPolicy maps ComponentInstall.UpgradeCRDs to a helmv2.CRDsPolicy.
-// Empty / nil preserves the helm-controller default (Skip on upgrade);
-// the CRD enum marker restricts the string to Skip/Create/CreateReplace.
-func parseCRDPolicy(install *cozyv1alpha1.ComponentInstall) helmv2.CRDsPolicy {
-	if install == nil || install.UpgradeCRDs == "" {
-		return ""
-	}
-	return helmv2.CRDsPolicy(install.UpgradeCRDs)
-}
-
 // PackageReconciler reconciles Package resources
 type PackageReconciler struct {
 	client.Client
@@ -231,7 +221,6 @@ func (r *PackageReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ct
 					Remediation: &helmv2.UpgradeRemediation{
 						Retries: -1,
 					},
-					CRDs: parseCRDPolicy(component.Install),
 				},
 			},
 		}
diff --git a/internal/operator/package_reconciler_test.go b/internal/operator/package_reconciler_test.go
deleted file mode 100644
index f0ee2c19..00000000
--- a/internal/operator/package_reconciler_test.go
+++ /dev/null
@@ -1,138 +0,0 @@
-/*
-Copyright 2025 The Cozystack Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package operator
-
-import (
-	"encoding/json"
-	"os"
-	"path/filepath"
-	"testing"
-
-	cozyv1alpha1 "github.com/cozystack/cozystack/api/v1alpha1"
-	helmv2 "github.com/fluxcd/helm-controller/api/v2"
-	apiextensionsv1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
-	"sigs.k8s.io/yaml"
-)
-
-func TestParseCRDPolicy(t *testing.T) {
-	tests := []struct {
-		name    string
-		install *cozyv1alpha1.ComponentInstall
-		want    helmv2.CRDsPolicy
-	}{
-		{
-			name:    "nil install leaves flux default",
-			install: nil,
-			want:    "",
-		},
-		{
-			name:    "empty upgradeCRDs leaves flux default",
-			install: &cozyv1alpha1.ComponentInstall{},
-			want:    "",
-		},
-		{
-			name:    "Skip is passed through",
-			install: &cozyv1alpha1.ComponentInstall{UpgradeCRDs: "Skip"},
-			want:    helmv2.Skip,
-		},
-		{
-			name:    "Create is passed through",
-			install: &cozyv1alpha1.ComponentInstall{UpgradeCRDs: "Create"},
-			want:    helmv2.Create,
-		},
-		{
-			name:    "CreateReplace is passed through",
-			install: &cozyv1alpha1.ComponentInstall{UpgradeCRDs: "CreateReplace"},
-			want:    helmv2.CreateReplace,
-		},
-	}
-
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			got := parseCRDPolicy(tc.install)
-			if got != tc.want {
-				t.Errorf("parseCRDPolicy() = %q, want %q", got, tc.want)
-			}
-		})
-	}
-}
-
-// TestPackageSourceCRDHasUpgradeCRDsEnum guards the generated CRD schema: the
-// invalid-value case from the spec is enforced at the API server via a
-// kubebuilder enum marker, not in the reconciler. If someone drops the marker
-// and forgets to regenerate, this test catches it.
-func TestPackageSourceCRDHasUpgradeCRDsEnum(t *testing.T) {
-	path := filepath.Join("..", "crdinstall", "manifests", "cozystack.io_packagesources.yaml")
-	data, err := os.ReadFile(path)
-	if err != nil {
-		t.Fatalf("read %s: %v", path, err)
-	}
-
-	var crd apiextensionsv1.CustomResourceDefinition
-	if err := yaml.Unmarshal(data, &crd); err != nil {
-		t.Fatalf("unmarshal CRD: %v", err)
-	}
-
-	var field *apiextensionsv1.JSONSchemaProps
-	for i := range crd.Spec.Versions {
-		v := &crd.Spec.Versions[i]
-		if v.Schema == nil || v.Schema.OpenAPIV3Schema == nil {
-			continue
-		}
-		spec, ok := v.Schema.OpenAPIV3Schema.Properties["spec"]
-		if !ok {
-			continue
-		}
-		variants, ok := spec.Properties["variants"]
-		if !ok || variants.Items == nil || variants.Items.Schema == nil {
-			continue
-		}
-		components, ok := variants.Items.Schema.Properties["components"]
-		if !ok || components.Items == nil || components.Items.Schema == nil {
-			continue
-		}
-		install, ok := components.Items.Schema.Properties["install"]
-		if !ok {
-			continue
-		}
-		f, ok := install.Properties["upgradeCRDs"]
-		if !ok {
-			continue
-		}
-		field = &f
-		break
-	}
-
-	if field == nil {
-		t.Fatal("upgradeCRDs field not found in PackageSource CRD schema")
-	}
-
-	got := map[string]bool{}
-	for _, e := range field.Enum {
-		var s string
-		if err := json.Unmarshal(e.Raw, &s); err != nil {
-			t.Fatalf("unmarshal enum value %q: %v", e.Raw, err)
-		}
-		got[s] = true
-	}
-
-	for _, want := range []string{"Skip", "Create", "CreateReplace"} {
-		if !got[want] {
-			t.Errorf("enum value %q missing from upgradeCRDs; got %v", want, got)
-		}
-	}
-}
diff --git a/packages/apps/kubernetes/Makefile b/packages/apps/kubernetes/Makefile
index 4fea42ef..01cf736d 100644
--- a/packages/apps/kubernetes/Makefile
+++ b/packages/apps/kubernetes/Makefile
@@ -4,9 +4,6 @@ KUBERNETES_PKG_TAG = $(shell awk '$$1 == "version:" {print $$2}' Chart.yaml)
 include ../../../hack/common-envs.mk
 include ../../../hack/package.mk
 
-test:
-	helm unittest .
-
 generate:
 	cozyvalues-gen -m 'kubernetes' -v values.yaml -s values.schema.json -r README.md -g ../../../api/apps/v1alpha1/kubernetes/types.go
 	../../../hack/update-crd.sh
@@ -70,4 +67,3 @@ image-cluster-autoscaler:
 	echo "$(REGISTRY)/cluster-autoscaler:$(call settag,$(KUBERNETES_PKG_TAG))@$$(yq e '."containerimage.digest"' images/cluster-autoscaler.json -o json -r)" \
 		> images/cluster-autoscaler.tag
 	rm -f images/cluster-autoscaler.json
-
diff --git a/packages/apps/kubernetes/README.md b/packages/apps/kubernetes/README.md
index bed1117a..d62d3a39 100644
--- a/packages/apps/kubernetes/README.md
+++ b/packages/apps/kubernetes/README.md
@@ -128,9 +128,6 @@ See the reference for components utilized in this service:
 | `addons.gpuOperator`                          | NVIDIA GPU Operator.                                                        | `object`   | `{}`      |
 | `addons.gpuOperator.enabled`                  | Enable GPU Operator.                                                        | `bool`     | `false`   |
 | `addons.gpuOperator.valuesOverride`           | Custom Helm values overrides.                                               | `object`   | `{}`      |
-| `addons.hami`                                 | HAMi GPU virtualization middleware.                                         | `object`   | `{}`      |
-| `addons.hami.enabled`                         | Enable HAMi (requires GPU Operator).                                        | `bool`     | `false`   |
-| `addons.hami.valuesOverride`                  | Custom Helm values overrides.                                               | `object`   | `{}`      |
 | `addons.fluxcd`                               | FluxCD GitOps operator.                                                     | `object`   | `{}`      |
 | `addons.fluxcd.enabled`                       | Enable FluxCD.                                                              | `bool`     | `false`   |
 | `addons.fluxcd.valuesOverride`                | Custom Helm values overrides.                                               | `object`   | `{}`      |
@@ -148,33 +145,31 @@ See the reference for components utilized in this service:
 
 ### Kubernetes Control Plane Configuration
 
-| Name                                                | Description                                                                                   | Type       | Value   |
-| --------------------------------------------------- | --------------------------------------------------------------------------------------------- | ---------- | ------- |
-| `controlPlane`                                      | Kubernetes control-plane configuration.                                                       | `object`   | `{}`    |
-| `controlPlane.replicas`                             | Number of control-plane replicas.                                                             | `int`      | `2`     |
-| `controlPlane.apiServer`                            | API Server configuration.                                                                     | `object`   | `{}`    |
-| `controlPlane.apiServer.resources`                  | CPU and memory resources for API Server.                                                      | `object`   | `{}`    |
-| `controlPlane.apiServer.resources.cpu`              | CPU available.                                                                                | `quantity` | `""`    |
-| `controlPlane.apiServer.resources.memory`           | Memory (RAM) available.                                                                       | `quantity` | `""`    |
-| `controlPlane.apiServer.resourcesPreset`            | Preset if `resources` omitted.                                                                | `string`   | `large` |
-| `controlPlane.controllerManager`                    | Controller Manager configuration.                                                             | `object`   | `{}`    |
-| `controlPlane.controllerManager.resources`          | CPU and memory resources for Controller Manager.                                              | `object`   | `{}`    |
-| `controlPlane.controllerManager.resources.cpu`      | CPU available.                                                                                | `quantity` | `""`    |
-| `controlPlane.controllerManager.resources.memory`   | Memory (RAM) available.                                                                       | `quantity` | `""`    |
-| `controlPlane.controllerManager.resourcesPreset`    | Preset if `resources` omitted.                                                                | `string`   | `micro` |
-| `controlPlane.scheduler`                            | Scheduler configuration.                                                                      | `object`   | `{}`    |
-| `controlPlane.scheduler.resources`                  | CPU and memory resources for Scheduler.                                                       | `object`   | `{}`    |
-| `controlPlane.scheduler.resources.cpu`              | CPU available.                                                                                | `quantity` | `""`    |
-| `controlPlane.scheduler.resources.memory`           | Memory (RAM) available.                                                                       | `quantity` | `""`    |
-| `controlPlane.scheduler.resourcesPreset`            | Preset if `resources` omitted.                                                                | `string`   | `micro` |
-| `controlPlane.konnectivity`                         | Konnectivity configuration.                                                                   | `object`   | `{}`    |
-| `controlPlane.konnectivity.server`                  | Konnectivity Server configuration.                                                            | `object`   | `{}`    |
-| `controlPlane.konnectivity.server.resources`        | CPU and memory resources for Konnectivity.                                                    | `object`   | `{}`    |
-| `controlPlane.konnectivity.server.resources.cpu`    | CPU available.                                                                                | `quantity` | `""`    |
-| `controlPlane.konnectivity.server.resources.memory` | Memory (RAM) available.                                                                       | `quantity` | `""`    |
-| `controlPlane.konnectivity.server.resourcesPreset`  | Preset if `resources` omitted.                                                                | `string`   | `micro` |
-| `images`                                            | Optional image overrides for air-gapped or rate-limited registries.                           | `object`   | `{}`    |
-| `images.waitForKubeconfig`                          | Image used by the wait-for-kubeconfig init container. Empty falls back to images/busybox.tag. | `string`   | `""`    |
+| Name                                                | Description                                      | Type       | Value   |
+| --------------------------------------------------- | ------------------------------------------------ | ---------- | ------- |
+| `controlPlane`                                      | Kubernetes control-plane configuration.          | `object`   | `{}`    |
+| `controlPlane.replicas`                             | Number of control-plane replicas.                | `int`      | `2`     |
+| `controlPlane.apiServer`                            | API Server configuration.                        | `object`   | `{}`    |
+| `controlPlane.apiServer.resources`                  | CPU and memory resources for API Server.         | `object`   | `{}`    |
+| `controlPlane.apiServer.resources.cpu`              | CPU available.                                   | `quantity` | `""`    |
+| `controlPlane.apiServer.resources.memory`           | Memory (RAM) available.                          | `quantity` | `""`    |
+| `controlPlane.apiServer.resourcesPreset`            | Preset if `resources` omitted.                   | `string`   | `large` |
+| `controlPlane.controllerManager`                    | Controller Manager configuration.                | `object`   | `{}`    |
+| `controlPlane.controllerManager.resources`          | CPU and memory resources for Controller Manager. | `object`   | `{}`    |
+| `controlPlane.controllerManager.resources.cpu`      | CPU available.                                   | `quantity` | `""`    |
+| `controlPlane.controllerManager.resources.memory`   | Memory (RAM) available.                          | `quantity` | `""`    |
+| `controlPlane.controllerManager.resourcesPreset`    | Preset if `resources` omitted.                   | `string`   | `micro` |
+| `controlPlane.scheduler`                            | Scheduler configuration.                         | `object`   | `{}`    |
+| `controlPlane.scheduler.resources`                  | CPU and memory resources for Scheduler.          | `object`   | `{}`    |
+| `controlPlane.scheduler.resources.cpu`              | CPU available.                                   | `quantity` | `""`    |
+| `controlPlane.scheduler.resources.memory`           | Memory (RAM) available.                          | `quantity` | `""`    |
+| `controlPlane.scheduler.resourcesPreset`            | Preset if `resources` omitted.                   | `string`   | `micro` |
+| `controlPlane.konnectivity`                         | Konnectivity configuration.                      | `object`   | `{}`    |
+| `controlPlane.konnectivity.server`                  | Konnectivity Server configuration.               | `object`   | `{}`    |
+| `controlPlane.konnectivity.server.resources`        | CPU and memory resources for Konnectivity.       | `object`   | `{}`    |
+| `controlPlane.konnectivity.server.resources.cpu`    | CPU available.                                   | `quantity` | `""`    |
+| `controlPlane.konnectivity.server.resources.memory` | Memory (RAM) available.                          | `quantity` | `""`    |
+| `controlPlane.konnectivity.server.resourcesPreset`  | Preset if `resources` omitted.                   | `string`   | `micro` |
 
 
 ## Parameter examples and reference
diff --git a/packages/apps/kubernetes/images/busybox.tag b/packages/apps/kubernetes/images/busybox.tag
deleted file mode 100644
index 39de220a..00000000
--- a/packages/apps/kubernetes/images/busybox.tag
+++ /dev/null
@@ -1 +0,0 @@
-docker.io/library/busybox:1.37.0@sha256:1487d0af5f52b4ba31c7e465126ee2123fe3f2305d638e7827681e7cf6c83d5e
diff --git a/packages/apps/kubernetes/images/kubevirt-csi-driver/Dockerfile b/packages/apps/kubernetes/images/kubevirt-csi-driver/Dockerfile
index b156d08e..5103e415 100644
--- a/packages/apps/kubernetes/images/kubevirt-csi-driver/Dockerfile
+++ b/packages/apps/kubernetes/images/kubevirt-csi-driver/Dockerfile
@@ -1,4 +1,4 @@
-ARG builder_image=docker.io/library/golang:1.22.5
+ARG builder_image=docker.io/library/golang:1.26
 FROM ${builder_image} AS builder
 
 ARG TARGETOS
diff --git a/packages/apps/kubernetes/images/kubevirt-csi-driver/go.mod b/packages/apps/kubernetes/images/kubevirt-csi-driver/go.mod
index 96a96107..53e57387 100644
--- a/packages/apps/kubernetes/images/kubevirt-csi-driver/go.mod
+++ b/packages/apps/kubernetes/images/kubevirt-csi-driver/go.mod
@@ -1,101 +1,95 @@
 module cozystack.io/kubevirt-csi-driver
 
-go 1.22.0
-
-toolchain go1.22.5
+go 1.26.2
 
 require (
 	github.com/container-storage-interface/spec v1.10.0
-	google.golang.org/grpc v1.65.0
+	google.golang.org/grpc v1.80.0
 	gopkg.in/yaml.v2 v2.4.0
-	k8s.io/api v0.31.4
-	k8s.io/apimachinery v0.31.4
+	k8s.io/api v0.36.0
+	k8s.io/apimachinery v0.36.0
 	k8s.io/client-go v12.0.0+incompatible
-	k8s.io/klog/v2 v2.130.1
-	k8s.io/mount-utils v0.33.1
+	k8s.io/klog/v2 v2.140.0
+	k8s.io/mount-utils v0.36.0
 	kubevirt.io/containerized-data-importer-api v1.59.0
-	kubevirt.io/csi-driver v0.0.0-20250702202414-a8d6605bc999
+	kubevirt.io/csi-driver v0.0.0-20260424143118-bee6c348c004
 )
 
 require (
-	github.com/coreos/go-systemd/v22 v22.5.0 // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
-	github.com/emicklei/go-restful/v3 v3.11.0 // indirect
-	github.com/fxamacker/cbor/v2 v2.7.0 // indirect
-	github.com/go-logr/logr v1.4.2 // indirect
-	github.com/go-openapi/jsonpointer v0.19.6 // indirect
+	github.com/emicklei/go-restful/v3 v3.13.0 // indirect
+	github.com/fxamacker/cbor/v2 v2.9.0 // indirect
+	github.com/go-logr/logr v1.4.3 // indirect
+	github.com/go-openapi/jsonpointer v0.21.0 // indirect
 	github.com/go-openapi/jsonreference v0.20.2 // indirect
-	github.com/go-openapi/swag v0.22.4 // indirect
-	github.com/godbus/dbus/v5 v5.1.0 // indirect
-	github.com/gogo/protobuf v1.3.2 // indirect
+	github.com/go-openapi/swag v0.23.0 // indirect
 	github.com/golang/mock v1.6.0 // indirect
 	github.com/golang/protobuf v1.5.4 // indirect
-	github.com/google/gnostic-models v0.6.8 // indirect
-	github.com/google/go-cmp v0.6.0 // indirect
-	github.com/google/gofuzz v1.2.0 // indirect
+	github.com/google/gnostic-models v0.7.0 // indirect
 	github.com/google/uuid v1.6.0 // indirect
-	github.com/imdario/mergo v0.3.15 // indirect
 	github.com/josharian/intern v1.0.0 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
 	github.com/kubernetes-csi/csi-lib-utils v0.18.1 // indirect
 	github.com/kubernetes-csi/external-snapshotter/client/v6 v6.3.0 // indirect
 	github.com/mailru/easyjson v0.7.7 // indirect
-	github.com/moby/sys/mountinfo v0.7.1 // indirect
+	github.com/moby/sys/mountinfo v0.7.2 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
-	github.com/modern-go/reflect2 v1.0.2 // indirect
+	github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
-	github.com/opencontainers/runc v1.1.13 // indirect
-	github.com/opencontainers/runtime-spec v1.0.3-0.20220909204839-494a5a6aca78 // indirect
 	github.com/openshift/api v0.0.0-20230503133300-8bbcb7ca7183 // indirect
 	github.com/openshift/custom-resource-status v1.1.2 // indirect
-	github.com/sirupsen/logrus v1.9.3 // indirect
-	github.com/spf13/pflag v1.0.5 // indirect
+	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
+	github.com/spf13/pflag v1.0.9 // indirect
 	github.com/x448/float16 v0.8.4 // indirect
-	golang.org/x/net v0.33.0 // indirect
-	golang.org/x/oauth2 v0.21.0 // indirect
-	golang.org/x/sys v0.28.0 // indirect
-	golang.org/x/term v0.27.0 // indirect
-	golang.org/x/text v0.21.0 // indirect
-	golang.org/x/time v0.3.0 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20240701130421-f6361c86f094 // indirect
-	google.golang.org/protobuf v1.34.2 // indirect
+	go.yaml.in/yaml/v2 v2.4.3 // indirect
+	go.yaml.in/yaml/v3 v3.0.4 // indirect
+	golang.org/x/net v0.53.0 // indirect
+	golang.org/x/oauth2 v0.36.0 // indirect
+	golang.org/x/sys v0.43.0 // indirect
+	golang.org/x/term v0.42.0 // indirect
+	golang.org/x/text v0.36.0 // indirect
+	golang.org/x/time v0.14.0 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20260128011058-8636f8732409 // indirect
+	google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af // indirect
+	gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 	k8s.io/apiextensions-apiserver v0.26.4 // indirect
-	k8s.io/kube-openapi v0.0.0-20240228011516-70dd3763d340 // indirect
-	k8s.io/utils v0.0.0-20240711033017-18e509b52bc8 // indirect
+	k8s.io/kube-openapi v0.0.0-20260317180543-43fb72c5454a // indirect
+	k8s.io/utils v0.0.0-20260210185600-b8788abfbbc2 // indirect
 	kubevirt.io/api v1.2.2 // indirect
 	kubevirt.io/controller-lifecycle-operator-sdk/api v0.0.0-20220329064328-f3cc58c6ed90 // indirect
-	sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd // indirect
-	sigs.k8s.io/structured-merge-diff/v4 v4.4.1 // indirect
-	sigs.k8s.io/yaml v1.4.0 // indirect
+	sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 // indirect
+	sigs.k8s.io/randfill v1.0.0 // indirect
+	sigs.k8s.io/structured-merge-diff/v6 v6.3.2 // indirect
+	sigs.k8s.io/yaml v1.6.0 // indirect
 )
 
 replace (
-	k8s.io/api => k8s.io/api v0.31.4
-	k8s.io/apiextensions-apiserver => k8s.io/apiextensions-apiserver v0.31.4
-	k8s.io/apimachinery => k8s.io/apimachinery v0.31.4
-	k8s.io/apiserver => k8s.io/apiserver v0.31.4
-	k8s.io/cli-runtime => k8s.io/cli-runtime v0.31.4
-	k8s.io/client-go => k8s.io/client-go v0.31.4
-	k8s.io/cloud-provider => k8s.io/cloud-provider v0.31.4
-	k8s.io/cluster-bootstrap => k8s.io/cluster-bootstrap v0.31.4
-	k8s.io/code-generator => k8s.io/code-generator v0.31.4
-	k8s.io/component-base => k8s.io/component-base v0.31.4
-	k8s.io/component-helpers => k8s.io/component-helpers v0.31.4
-	k8s.io/controller-manager => k8s.io/controller-manager v0.31.4
-	k8s.io/cri-api => k8s.io/cri-api v0.31.4
-	k8s.io/csi-translation-lib => k8s.io/csi-translation-lib v0.31.4
-	k8s.io/kube-aggregator => k8s.io/kube-aggregator v0.31.4
-	k8s.io/kube-controller-manager => k8s.io/kube-controller-manager v0.31.4
-	k8s.io/kube-proxy => k8s.io/kube-proxy v0.31.4
-	k8s.io/kube-scheduler => k8s.io/kube-scheduler v0.31.4
-	k8s.io/kubectl => k8s.io/kubectl v0.31.4
-	k8s.io/kubelet => k8s.io/kubelet v0.31.4
-	k8s.io/legacy-cloud-providers => k8s.io/legacy-cloud-providers v0.31.4
-	k8s.io/metrics => k8s.io/metrics v0.31.4
-	k8s.io/mount-utils => k8s.io/mount-utils v0.31.4
-	k8s.io/pod-security-admission => k8s.io/pod-security-admission v0.31.4
-	k8s.io/sample-apiserver => k8s.io/sample-apiserver v0.31.4
-	kubevirt.io/csi-driver => github.com/kubevirt/csi-driver v0.0.0-20250702202414-a8d6605bc999
+	k8s.io/api => k8s.io/api v0.36.0
+	k8s.io/apiextensions-apiserver => k8s.io/apiextensions-apiserver v0.36.0
+	k8s.io/apimachinery => k8s.io/apimachinery v0.36.0
+	k8s.io/apiserver => k8s.io/apiserver v0.36.0
+	k8s.io/cli-runtime => k8s.io/cli-runtime v0.36.0
+	k8s.io/client-go => k8s.io/client-go v0.36.0
+	k8s.io/cloud-provider => k8s.io/cloud-provider v0.36.0
+	k8s.io/cluster-bootstrap => k8s.io/cluster-bootstrap v0.36.0
+	k8s.io/code-generator => k8s.io/code-generator v0.36.0
+	k8s.io/component-base => k8s.io/component-base v0.36.0
+	k8s.io/component-helpers => k8s.io/component-helpers v0.36.0
+	k8s.io/controller-manager => k8s.io/controller-manager v0.36.0
+	k8s.io/cri-api => k8s.io/cri-api v0.36.0
+	k8s.io/csi-translation-lib => k8s.io/csi-translation-lib v0.36.0
+	k8s.io/kube-aggregator => k8s.io/kube-aggregator v0.36.0
+	k8s.io/kube-controller-manager => k8s.io/kube-controller-manager v0.36.0
+	k8s.io/kube-proxy => k8s.io/kube-proxy v0.36.0
+	k8s.io/kube-scheduler => k8s.io/kube-scheduler v0.36.0
+	k8s.io/kubectl => k8s.io/kubectl v0.36.0
+	k8s.io/kubelet => k8s.io/kubelet v0.36.0
+	k8s.io/legacy-cloud-providers => k8s.io/legacy-cloud-providers v0.36.0
+	k8s.io/metrics => k8s.io/metrics v0.36.0
+	k8s.io/mount-utils => k8s.io/mount-utils v0.36.0
+	k8s.io/pod-security-admission => k8s.io/pod-security-admission v0.36.0
+	k8s.io/sample-apiserver => k8s.io/sample-apiserver v0.36.0
+	kubevirt.io/csi-driver => github.com/kubevirt/csi-driver v0.0.0-20260424143118-bee6c348c004
 )
diff --git a/packages/apps/kubernetes/images/kubevirt-csi-driver/go.sum b/packages/apps/kubernetes/images/kubevirt-csi-driver/go.sum
index a0c4ac81..a37904b0 100644
--- a/packages/apps/kubernetes/images/kubevirt-csi-driver/go.sum
+++ b/packages/apps/kubernetes/images/kubevirt-csi-driver/go.sum
@@ -1,21 +1,16 @@
 github.com/NYTimes/gziphandler v0.0.0-20170623195520-56545f4a5d46/go.mod h1:3wb06e3pkSAbeQ52E9H9iFoQsEEwGN64994WTCIhntQ=
+github.com/NYTimes/gziphandler v1.1.1/go.mod h1:n/CVRwUEOgIxrgPvAQhUUr9oeUtvrhMomdKFjzJNB0c=
 github.com/PuerkitoBio/purell v1.1.1/go.mod h1:c11w/QuzBsJSee3cPx9rAFu61PvFxuPbtSwDGJws/X0=
 github.com/PuerkitoBio/urlesc v0.0.0-20170810143723-de5bf2ad4578/go.mod h1:uGdkoq3SwY9Y+13GIhn11/XLaGBb4BfwItxLd5jeuXE=
 github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5/go.mod h1:wHh0iHkYZB8zMSxRWpUBQtwG5a7fFgvEO+odwuTv2gs=
 github.com/asaskevich/govalidator v0.0.0-20190424111038-f61b66f89f4a/go.mod h1:lB+ZfQJz7igIIfQNfa7Ml4HSf2uFQQRzpGGRXenZAgY=
-github.com/chromedp/cdproto v0.0.0-20230802225258-3cf4e6d46a89/go.mod h1:GKljq0VrfU4D5yc+2qA6OVr8pmO/MBbPEWqWQ/oqGEs=
-github.com/chromedp/chromedp v0.9.2/go.mod h1:LkSXJKONWTCHAfQasKFUZI+mxqS4tZqhmtGzzhLsnLs=
-github.com/chromedp/sysutil v1.0.0/go.mod h1:kgWmDdq8fTzXYcKIBqIYvRRTnYb9aNS9moAV0xufSww=
+github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
+github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
 github.com/chzyer/logex v1.1.10/go.mod h1:+Ywpsq7O8HXn0nuIou7OrIPyXbp3wmkHB+jjWRnGsAI=
-github.com/chzyer/logex v1.2.1/go.mod h1:JLbx6lG2kDbNRFnfkgvh4eRJRPX1QCoOIWomwysCBrQ=
 github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e/go.mod h1:nSuG5e5PlCu98SY8svDHJxuZscDgtXS6KTTbou5AhLI=
-github.com/chzyer/readline v1.5.1/go.mod h1:Eh+b79XXUwfKfcPLepksvw2tcLE/Ct21YObkaSkeBlk=
 github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMnBNeIyt5eFwwo7qiLfzFZmjNmxjkiQlU=
-github.com/chzyer/test v1.0.0/go.mod h1:2JlltgoNkt4TW/z9V/IzDdFaMTM2JPIi26O1pF38GC8=
 github.com/container-storage-interface/spec v1.10.0 h1:YkzWPV39x+ZMTa6Ax2czJLLwpryrQ+dPesB34mrRMXA=
 github.com/container-storage-interface/spec v1.10.0/go.mod h1:DtUvaQszPml1YJfIK7c00mlv6/g4wNMLanLgiUbKFRI=
-github.com/coreos/go-systemd/v22 v22.5.0 h1:RrqgGjYQKalulkV8NGVIfkXQf6YYmOyiJKk8iXXhfZs=
-github.com/coreos/go-systemd/v22 v22.5.0/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSVTIJ3seZv2GcEnc=
 github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
@@ -24,28 +19,30 @@ github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8Yc
 github.com/docopt/docopt-go v0.0.0-20180111231733-ee0de3bc6815/go.mod h1:WwZ+bS3ebgob9U8Nd0kOddGdZWjyMGR8Wziv+TBNwSE=
 github.com/emicklei/go-restful v0.0.0-20170410110728-ff4f55a20633/go.mod h1:otzb+WCGbkyDHkqmQmT5YD2WR4BBwUdeQoFo8l/7tVs=
 github.com/emicklei/go-restful v2.15.0+incompatible/go.mod h1:otzb+WCGbkyDHkqmQmT5YD2WR4BBwUdeQoFo8l/7tVs=
-github.com/emicklei/go-restful/v3 v3.8.0/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc=
-github.com/emicklei/go-restful/v3 v3.11.0 h1:rAQeMHw1c7zTmncogyy8VvRZwtkmkZ4FxERmMY4rD+g=
 github.com/emicklei/go-restful/v3 v3.11.0/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc=
+github.com/emicklei/go-restful/v3 v3.13.0 h1:C4Bl2xDndpU6nJ4bc1jXd+uTmYPVUwkD6bFY/oTyCes=
+github.com/emicklei/go-restful/v3 v3.13.0/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc=
 github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo=
 github.com/fsnotify/fsnotify v1.4.9/go.mod h1:znqG4EE+3YCdAaPaxE2ZRY/06pZUdp0tY4IgpuI1SZQ=
-github.com/fxamacker/cbor/v2 v2.7.0 h1:iM5WgngdRBanHcxugY4JySA0nk1wZorNOpTgCMedv5E=
-github.com/fxamacker/cbor/v2 v2.7.0/go.mod h1:pxXPTn3joSm21Gbwsv0w9OSA2y1HFR9qXEeXQVeNoDQ=
+github.com/fxamacker/cbor/v2 v2.9.0 h1:NpKPmjDBgUfBms6tr6JZkTHtfFGcMKsw3eGcmD/sapM=
+github.com/fxamacker/cbor/v2 v2.9.0/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ=
 github.com/getkin/kin-openapi v0.76.0/go.mod h1:660oXbgy5JFMKreazJaQTw7o+X00qeSyhcnluiMv+Xg=
 github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
 github.com/go-logr/logr v0.1.0/go.mod h1:ixOQHD9gLJUVQQ2ZOR7zLEifBX6tGkNJF4QyIY7sIas=
 github.com/go-logr/logr v0.2.0/go.mod h1:z6/tIYblkpsD+a4lm/fGIIU9mZ+XfAiaFtq7xTgseGU=
 github.com/go-logr/logr v1.2.0/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
 github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
-github.com/go-logr/logr v1.2.3/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
-github.com/go-logr/logr v1.2.4/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
 github.com/go-logr/logr v1.4.1/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
-github.com/go-logr/logr v1.4.2 h1:6pFjapn8bFcIbiKo3XT4j/BhANplGihG6tvd+8rYgrY=
 github.com/go-logr/logr v1.4.2/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
+github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
+github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
 github.com/go-openapi/jsonpointer v0.19.3/go.mod h1:Pl9vOtqEWErmShwVjC8pYs9cog34VGT37dQOVbmoatg=
 github.com/go-openapi/jsonpointer v0.19.5/go.mod h1:Pl9vOtqEWErmShwVjC8pYs9cog34VGT37dQOVbmoatg=
-github.com/go-openapi/jsonpointer v0.19.6 h1:eCs3fxoIi3Wh6vtgmLTOjdhSpiqphQ+DaPn38N2ZdrE=
 github.com/go-openapi/jsonpointer v0.19.6/go.mod h1:osyAmYz/mB/C3I+WsTTSgw1ONzaLJoLCyoi6/zppojs=
+github.com/go-openapi/jsonpointer v0.21.0 h1:YgdVicSA9vH5RiHs9TZW5oyafXZFc6+2Vc1rr/O9oNQ=
+github.com/go-openapi/jsonpointer v0.21.0/go.mod h1:IUyH9l/+uyhIYQ/PXVA41Rexl+kOkAPDdXEYns6fzUY=
 github.com/go-openapi/jsonreference v0.19.3/go.mod h1:rjx6GuL8TTa9VaixXglHmQmIL98+wF9xc8zWvFonSJ8=
 github.com/go-openapi/jsonreference v0.19.6/go.mod h1:diGHMEHg2IqXZGKxqyvWdfWU/aim5Dprw5bqpKkTvns=
 github.com/go-openapi/jsonreference v0.20.1/go.mod h1:Bl1zwGIM8/wsvqjsOQLJ/SH+En5Ap4rVB5KVcIDZG2k=
@@ -54,20 +51,12 @@ github.com/go-openapi/jsonreference v0.20.2/go.mod h1:Bl1zwGIM8/wsvqjsOQLJ/SH+En
 github.com/go-openapi/swag v0.19.5/go.mod h1:POnQmlKehdgb5mhVOsnJFsivZCEZ/vjK9gh66Z9tfKk=
 github.com/go-openapi/swag v0.21.1/go.mod h1:QYRuS/SOXUCsnplDa677K7+DxSOj6IPNl/eQntq43wQ=
 github.com/go-openapi/swag v0.22.3/go.mod h1:UzaqsxGiab7freDnrUUra0MwWfN/q7tE4j+VcZ0yl14=
-github.com/go-openapi/swag v0.22.4 h1:QLMzNJnMGPRNDCbySlcj1x01tzU8/9LTTL9hZZZogBU=
-github.com/go-openapi/swag v0.22.4/go.mod h1:UzaqsxGiab7freDnrUUra0MwWfN/q7tE4j+VcZ0yl14=
+github.com/go-openapi/swag v0.23.0 h1:vsEVJDUo2hPJ2tu0/Xc+4noaxyEffXNIs3cOULZ+GrE=
+github.com/go-openapi/swag v0.23.0/go.mod h1:esZ8ITTYEsH1V2trKHjAN8Ai7xHb8RV+YSZ577vPjgQ=
+github.com/go-task/slim-sprig v0.0.0-20210107165309-348f09dbbbc0 h1:p104kn46Q8WdvHunIJ9dAyjPVtrBPhSr3KT2yUst43I=
 github.com/go-task/slim-sprig v0.0.0-20210107165309-348f09dbbbc0/go.mod h1:fyg7847qk6SyHyPtNmDHnmrv/HOrqktSC+C9fM+CJOE=
-github.com/go-task/slim-sprig v0.0.0-20230315185526-52ccab3ef572 h1:tfuBGBXKqDEevZMzYi5KSi8KkcZtzBcTgAUUtapy0OI=
-github.com/go-task/slim-sprig v0.0.0-20230315185526-52ccab3ef572/go.mod h1:9Pwr4B2jHnOSGXyyzV8ROjYa2ojvAY6HCGYYfMoC3Ls=
 github.com/go-task/slim-sprig/v3 v3.0.0 h1:sUs3vkvUymDpBKi3qH1YSqBQk9+9D/8M2mN1vB6EwHI=
 github.com/go-task/slim-sprig/v3 v3.0.0/go.mod h1:W848ghGpv3Qj3dhTPRyJypKRiqCdHZiAzKg9hl15HA8=
-github.com/gobwas/httphead v0.1.0/go.mod h1:O/RXo79gxV8G+RqlR/otEwx4Q36zl9rqC5u12GKvMCM=
-github.com/gobwas/pool v0.2.1/go.mod h1:q8bcK0KcYlCgd9e7WYLm9LpyS+YeLd8JVDW6WezmKEw=
-github.com/gobwas/ws v1.2.1/go.mod h1:hRKAFb8wOxFROYNsT1bqfWnhX+b5MFeJM9r2ZSwg/KY=
-github.com/godbus/dbus/v5 v5.0.4/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
-github.com/godbus/dbus/v5 v5.1.0 h1:4KLkAxT3aOY8Li4FRJe/KvhoNFFxo0m6fNuFUO8QJUk=
-github.com/godbus/dbus/v5 v5.1.0/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
-github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
 github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
 github.com/golang/mock v1.6.0 h1:ErTB+efbowRARo13NNdxyJji2egdxLGQhRaY+DUumQc=
 github.com/golang/mock v1.6.0/go.mod h1:p6yTPP+5HYm5mzsMV8JkE6ZKdX+/wYM6Hr+LicevLPs=
@@ -80,25 +69,21 @@ github.com/golang/protobuf v1.4.0/go.mod h1:jodUvKwWbYaEsadDk5Fwe5c77LiNKVO9IDvq
 github.com/golang/protobuf v1.4.2/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
 github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk=
 github.com/golang/protobuf v1.5.2/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
-github.com/golang/protobuf v1.5.3/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
 github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
 github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
-github.com/google/gnostic-models v0.6.8 h1:yo/ABAfM5IMRsS1VnXjTBvUb61tFIHozhlYvRgGre9I=
-github.com/google/gnostic-models v0.6.8/go.mod h1:5n7qKqH0f5wFt+aWF8CW6pZLLNOfYuF5OpfBSENuI8U=
+github.com/google/gnostic-models v0.7.0 h1:qwTtogB15McXDaNqTZdzPJRHvaVJlAl+HVQnLmJEJxo=
+github.com/google/gnostic-models v0.7.0/go.mod h1:whL5G0m6dmc5cPxKc5bdKdEN3UjI7OUGxBlw57miDrQ=
 github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
 github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
 github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.8/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
-github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
 github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
+github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
+github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
 github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
 github.com/google/gofuzz v1.1.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
-github.com/google/gofuzz v1.2.0 h1:xRy4A+RhZaiKjJ1bPfwQ8sedCA+YS2YcCHW6ec7JMi0=
-github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
 github.com/google/pprof v0.0.0-20210407192527-94a9f03dee38/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
-github.com/google/pprof v0.0.0-20240424215950-a892ee059fd6/go.mod h1:kf6iHlnVGwgKolg33glAes7Yg/8iWP8ukqeldJSO7jw=
 github.com/google/pprof v0.0.0-20240525223248-4bfdf5a9a2af h1:kmjWCqn2qkEml422C2Rrd27c3VGxi6a/6HNq8QmHRKM=
 github.com/google/pprof v0.0.0-20240525223248-4bfdf5a9a2af/go.mod h1:K1liHPHnj73Fdn/EKuT8nrFqBihUSKXoLYU0BuatOYo=
 github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
@@ -108,9 +93,6 @@ github.com/googleapis/gnostic v0.5.1/go.mod h1:6U4PtQXGIEt/Z3h5MAT7FNofLnw9vXk2c
 github.com/gorilla/mux v1.8.0/go.mod h1:DVbg23sWSpFRCP0SfiEN6jmj59UnW/n46BH5rLB71So=
 github.com/hpcloud/tail v1.0.0/go.mod h1:ab1qPbhIpdTxEkNHXyeSf5vhxWSCs/tWer42PpOxQnU=
 github.com/ianlancetaylor/demangle v0.0.0-20200824232613-28f6c0f3b639/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc=
-github.com/ianlancetaylor/demangle v0.0.0-20240312041847-bd984b5ce465/go.mod h1:gx7rwoVhcfuVKG5uya9Hs3Sxj7EIvldVofAWIUtGouw=
-github.com/imdario/mergo v0.3.15 h1:M8XP7IuFNsqUx6VPK2P9OSmsYsI/YFaGil0uD21V3dM=
-github.com/imdario/mergo v0.3.15/go.mod h1:WBLT9ZmE3lPoWsEzCh9LPo3TiwVN+ZKEjmz+hD27ysY=
 github.com/josharian/intern v1.0.0 h1:vlS4z54oSdjm0bgjRigI+G1HpF+tI+9rE5LLzOg8HmY=
 github.com/josharian/intern v1.0.0/go.mod h1:5DoeVV0s6jJacbCEi61lwdGj/aVlrQvzHFFd8Hwg//Y=
 github.com/json-iterator/go v1.1.6/go.mod h1:+SdeFBvtyEkXs7REEP0seUULqWtbJapLOCVDaaPEHmU=
@@ -131,24 +113,24 @@ github.com/kubernetes-csi/csi-lib-utils v0.18.1 h1:vpg1kbQ6lFVCz7mY71zcqVE7W0GAQ
 github.com/kubernetes-csi/csi-lib-utils v0.18.1/go.mod h1:PIcn27zmbY0KBue4JDdZVfDF56tjcS3jKroZPi+pMoY=
 github.com/kubernetes-csi/external-snapshotter/client/v6 v6.3.0 h1:qS4r4ljINLWKJ9m9Ge3Q3sGZ/eIoDVDT2RhAdQFHb1k=
 github.com/kubernetes-csi/external-snapshotter/client/v6 v6.3.0/go.mod h1:oGXx2XTEzs9ikW2V6IC1dD8trgjRsS/Mvc2JRiC618Y=
-github.com/kubevirt/csi-driver v0.0.0-20250702202414-a8d6605bc999 h1:nq11swNPIRarVZm/YTOWh9rbuEqivgpA1c4RUEFSL90=
-github.com/kubevirt/csi-driver v0.0.0-20250702202414-a8d6605bc999/go.mod h1:Pzl14YlqPpoK/ZdS79tUSuHbC2L/NPqOIjFTN5kTmUg=
-github.com/ledongthuc/pdf v0.0.0-20220302134840-0c2507a12d80/go.mod h1:imJHygn/1yfhB7XSJJKlFZKl/J+dCPAknuiaGOshXAs=
+github.com/kubevirt/csi-driver v0.0.0-20260424143118-bee6c348c004 h1:fEnd+1kIEuzpFJt9slCylHsgPmxyLFO8K83hrToMkWs=
+github.com/kubevirt/csi-driver v0.0.0-20260424143118-bee6c348c004/go.mod h1:Pzl14YlqPpoK/ZdS79tUSuHbC2L/NPqOIjFTN5kTmUg=
 github.com/mailru/easyjson v0.0.0-20190614124828-94de47d64c63/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc=
 github.com/mailru/easyjson v0.0.0-20190626092158-b2ccc519800e/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc=
 github.com/mailru/easyjson v0.7.6/go.mod h1:xzfreul335JAWq5oZzymOObrkdz5UnU4kGfJJLY9Nlc=
 github.com/mailru/easyjson v0.7.7 h1:UGYAvKxe3sBsEDzO8ZeWOSlIQfWFlxbzLZe7hwFURr0=
 github.com/mailru/easyjson v0.7.7/go.mod h1:xzfreul335JAWq5oZzymOObrkdz5UnU4kGfJJLY9Nlc=
 github.com/mitchellh/mapstructure v1.1.2/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y=
-github.com/moby/spdystream v0.4.0/go.mod h1:xBAYlnt/ay+11ShkdFKNAG7LsyK/tmNBVvVOwrfMgdI=
-github.com/moby/sys/mountinfo v0.7.1 h1:/tTvQaSJRr2FshkhXiIpux6fQ2Zvc4j7tAhMTStAG2g=
-github.com/moby/sys/mountinfo v0.7.1/go.mod h1:IJb6JQeOklcdMU9F5xQ8ZALD+CUr5VlGpwtX+VE0rpI=
+github.com/moby/spdystream v0.5.1/go.mod h1:xBAYlnt/ay+11ShkdFKNAG7LsyK/tmNBVvVOwrfMgdI=
+github.com/moby/sys/mountinfo v0.7.2 h1:1shs6aH5s4o5H2zQLn796ADW1wMrIwHsyJ2v9KouLrg=
+github.com/moby/sys/mountinfo v0.7.2/go.mod h1:1YOa8w8Ih7uW0wALDUgT1dTTSBrZ+HiBLGws92L2RU4=
 github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
 github.com/modern-go/reflect2 v1.0.1/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
-github.com/modern-go/reflect2 v1.0.2 h1:xBagoLtFs94CBntxluKeaWgTMpvLxC4ur3nMaC9Gz0M=
 github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
+github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee h1:W5t00kpgFdJifH4BDsTlE89Zl93FEloxaWZfGcifgq8=
+github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
 github.com/munnerz/goautoneg v0.0.0-20120707110453-a547fc61f48d/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
@@ -162,23 +144,6 @@ github.com/onsi/ginkgo v1.12.1/go.mod h1:zj2OWP4+oCPe1qIXoGWkgMRwljMUYCdkwsT2108
 github.com/onsi/ginkgo v1.16.4 h1:29JGrr5oVBm5ulCWet69zQkzWipVXIol6ygQUe/EzNc=
 github.com/onsi/ginkgo v1.16.4/go.mod h1:dX+/inL/fNMqNlz0e9LfyB9TswhZpCVdJM/Z6Vvnwo0=
 github.com/onsi/ginkgo/v2 v2.0.0/go.mod h1:vw5CSIxN1JObi/U8gcbwft7ZxR2dgaR70JSE3/PpL4c=
-github.com/onsi/ginkgo/v2 v2.1.3/go.mod h1:vw5CSIxN1JObi/U8gcbwft7ZxR2dgaR70JSE3/PpL4c=
-github.com/onsi/ginkgo/v2 v2.1.4/go.mod h1:um6tUpWM/cxCK3/FK8BXqEiUMUwRgSM4JXG47RKZmLU=
-github.com/onsi/ginkgo/v2 v2.1.6/go.mod h1:MEH45j8TBi6u9BMogfbp0stKC5cdGjumZj5Y7AG4VIk=
-github.com/onsi/ginkgo/v2 v2.3.0/go.mod h1:Eew0uilEqZmIEZr8JrvYlvOM7Rr6xzTmMV8AyFNU9d0=
-github.com/onsi/ginkgo/v2 v2.4.0/go.mod h1:iHkDK1fKGcBoEHT5W7YBq4RFWaQulw+caOMkAt4OrFo=
-github.com/onsi/ginkgo/v2 v2.5.0/go.mod h1:Luc4sArBICYCS8THh8v3i3i5CuSZO+RaQRaJoeNwomw=
-github.com/onsi/ginkgo/v2 v2.7.0/go.mod h1:yjiuMwPokqY1XauOgju45q3sJt6VzQ/Fict1LFVcsAo=
-github.com/onsi/ginkgo/v2 v2.8.1/go.mod h1:N1/NbDngAFcSLdyZ+/aYTYGSlq9qMCS/cNKGJjy+csc=
-github.com/onsi/ginkgo/v2 v2.9.0/go.mod h1:4xkjoL/tZv4SMWeww56BU5kAt19mVB47gTWxmrTcxyk=
-github.com/onsi/ginkgo/v2 v2.9.1/go.mod h1:FEcmzVcCHl+4o9bQZVab+4dC9+j+91t2FHSzmGAPfuo=
-github.com/onsi/ginkgo/v2 v2.9.2/go.mod h1:WHcJJG2dIlcCqVfBAwUCrJxSPFb6v4azBwgxeMeDuts=
-github.com/onsi/ginkgo/v2 v2.9.5/go.mod h1:tvAoo1QUJwNEU2ITftXTpR7R1RbCzoZUOs3RonqW57k=
-github.com/onsi/ginkgo/v2 v2.9.7/go.mod h1:cxrmXWykAwTwhQsJOPfdIDiJ+l2RYq7U8hFU+M/1uw0=
-github.com/onsi/ginkgo/v2 v2.11.0/go.mod h1:ZhrRA5XmEE3x3rhlzamx/JJvujdZoJ2uvgI7kR0iZvM=
-github.com/onsi/ginkgo/v2 v2.13.0/go.mod h1:TE309ZR8s5FsKKpuB1YAQYBzCaAfUgatB/xlT/ETL/o=
-github.com/onsi/ginkgo/v2 v2.17.1/go.mod h1:llBI3WDLL9Z6taip6f33H76YcWtJv+7R3HigUjbIBOs=
-github.com/onsi/ginkgo/v2 v2.17.2/go.mod h1:nP2DPOQoNsQmsVyv5rDA8JkXQoCs6goXIvr/PRJ1eCc=
 github.com/onsi/ginkgo/v2 v2.19.0 h1:9Cnnf7UHo57Hy3k6/m5k3dRfGTMXGvxhHFvkDTCTpvA=
 github.com/onsi/ginkgo/v2 v2.19.0/go.mod h1:rlwLi9PilAFJ8jCg9UE1QP6VBpd6/xj3SRC0d6TU0To=
 github.com/onsi/gomega v0.0.0-20170829124025-dcabb60a477c/go.mod h1:C1qb7wdrVGGVU+Z6iS04AVkA3Q65CEZX59MT0QO5uiA=
@@ -186,62 +151,40 @@ github.com/onsi/gomega v1.7.1/go.mod h1:XdKZgCCFLUoM/7CFJVPcG8C1xQ1AJ0vpAezJrB7J
 github.com/onsi/gomega v1.10.1/go.mod h1:iN09h71vgCQne3DLsj+A5owkum+a2tYe+TOCB1ybHNo=
 github.com/onsi/gomega v1.17.0/go.mod h1:HnhC7FXeEQY45zxNK3PPoIUhzk/80Xly9PcubAlGdZY=
 github.com/onsi/gomega v1.18.1/go.mod h1:0q+aL8jAiMXy9hbwj2mr5GziHiwhAIQpFmmtT5hitRs=
-github.com/onsi/gomega v1.19.0/go.mod h1:LY+I3pBVzYsTBU1AnDwOSxaYi9WoWiqgwooUqq9yPro=
-github.com/onsi/gomega v1.20.1/go.mod h1:DtrZpjmvpn2mPm4YWQa0/ALMDj9v4YxLgojwPeREyVo=
-github.com/onsi/gomega v1.21.1/go.mod h1:iYAIXgPSaDHak0LCMA+AWBpIKBr8WZicMxnE8luStNc=
-github.com/onsi/gomega v1.22.1/go.mod h1:x6n7VNe4hw0vkyYUM4mjIXx3JbLiPaBPNgB7PRQ1tuM=
-github.com/onsi/gomega v1.24.0/go.mod h1:Z/NWtiqwBrwUt4/2loMmHL63EDLnYHmVbuBpDr2vQAg=
-github.com/onsi/gomega v1.24.1/go.mod h1:3AOiACssS3/MajrniINInwbfOOtfZvplPzuRSmvt1jM=
-github.com/onsi/gomega v1.26.0/go.mod h1:r+zV744Re+DiYCIPRlYOTxn0YkOLcAnW8k1xXdMPGhM=
-github.com/onsi/gomega v1.27.1/go.mod h1:aHX5xOykVYzWOV4WqQy0sy8BQptgukenXpCXfadcIAw=
-github.com/onsi/gomega v1.27.3/go.mod h1:5vG284IBtfDAmDyrK+eGyZmUgUlmi+Wngqo557cZ6Gw=
-github.com/onsi/gomega v1.27.4/go.mod h1:riYq/GJKh8hhoM01HN6Vmuy93AarCXCBGpvFDK3q3fQ=
-github.com/onsi/gomega v1.27.6/go.mod h1:PIQNjfQwkP3aQAH7lf7j87O/5FiNr+ZR8+ipb+qQlhg=
-github.com/onsi/gomega v1.27.7/go.mod h1:1p8OOlwo2iUUDsHnOrjE5UKYJ+e3W8eQ3qSlRahPmr4=
-github.com/onsi/gomega v1.27.8/go.mod h1:2J8vzI/s+2shY9XHRApDkdgPo1TKT7P2u6fXeJKFnNQ=
-github.com/onsi/gomega v1.27.10/go.mod h1:RsS8tutOdbdgzbPtzzATp12yT7kM5I5aElG3evPbQ0M=
-github.com/onsi/gomega v1.30.0/go.mod h1:9sxs+SwGrKI0+PWe4Fxa9tFQQBG5xSsSbMXOI8PPpoQ=
-github.com/onsi/gomega v1.33.0/go.mod h1:+925n5YtiFsLzzafLUHzVMBpvvRAzrydIBiSIxjX3wY=
 github.com/onsi/gomega v1.33.1 h1:dsYjIxxSR755MDmKVsaFQTE22ChNBcuuTWgkUDSubOk=
 github.com/onsi/gomega v1.33.1/go.mod h1:U4R44UsT+9eLIaYRB2a5qajjtQYn0hauxvRm16AVYg0=
-github.com/opencontainers/runc v1.1.13 h1:98S2srgG9vw0zWcDpFMn5TRrh8kLxa/5OFUstuUhmRs=
-github.com/opencontainers/runc v1.1.13/go.mod h1:R016aXacfp/gwQBYw2FDGa9m+n6atbLWrYY8hNMT/sA=
-github.com/opencontainers/runtime-spec v1.0.3-0.20220909204839-494a5a6aca78 h1:R5M2qXZiK/mWPMT4VldCOiSL9HIAMuxQZWdG0CSM5+4=
-github.com/opencontainers/runtime-spec v1.0.3-0.20220909204839-494a5a6aca78/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0=
 github.com/openshift/api v0.0.0-20230503133300-8bbcb7ca7183 h1:t/CahSnpqY46sQR01SoS+Jt0jtjgmhgE6lFmRnO4q70=
 github.com/openshift/api v0.0.0-20230503133300-8bbcb7ca7183/go.mod h1:4VWG+W22wrB4HfBL88P40DxLEpSOaiBVxUnfalfJo9k=
 github.com/openshift/custom-resource-status v1.1.2 h1:C3DL44LEbvlbItfd8mT5jWrqPfHnSOQoQf/sypqA6A4=
 github.com/openshift/custom-resource-status v1.1.2/go.mod h1:DB/Mf2oTeiAmVVX1gN+NEqweonAPY0TKUwADizj8+ZA=
-github.com/orisano/pixelmatch v0.0.0-20220722002657-fb0b55479cde/go.mod h1:nZgzbfBr3hhjoZnS66nKrHmduYNpc34ny7RK4z5/HM0=
 github.com/pkg/diff v0.0.0-20210226163009-20ebb0f2a09e/go.mod h1:pJLUxLENpZxwdsKMEsNbx1VGcRFpLqf3715MtcvvzbA=
-github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
-github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/rogpeppe/go-internal v1.9.0/go.mod h1:WtVeX8xhTBvf0smdhujwtBcq4Qrzq/fJaraNFVN+nFs=
-github.com/rogpeppe/go-internal v1.12.0 h1:exVL4IDcn6na9z1rAb56Vxr+CgyK3nn3O+epU5NdKM8=
 github.com/rogpeppe/go-internal v1.12.0/go.mod h1:E+RYuTGaKKdloAfM02xzb0FW3Paa99yedzYV+kq4uf4=
-github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
-github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
+github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=
+github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc=
 github.com/spf13/afero v1.2.2/go.mod h1:9ZxEEn6pIJ8Rxe320qSDBk6AsU0r9pR7Q4OcevTdifk=
-github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=
 github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/spf13/pflag v1.0.9 h1:9exaQaMOCwffKiiiYk6/BndUBv+iRViNW+4lEMi0PvY=
+github.com/spf13/pflag v1.0.9/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 github.com/stoewer/go-strcase v1.2.0/go.mod h1:IBiWB2sKIp3wVVQ3Y035++gc+knqhUQag1KpM8ahLw8=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
 github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
+github.com/stretchr/objx v0.5.2 h1:xuMeJ0Sdp5ZMRXx/aWO6RZxdr3beISkG5/G/aIRr3pY=
 github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
 github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA=
 github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
 github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
 github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
-github.com/stretchr/testify v1.9.0 h1:HtqpIVDClZ4nwg75+f6Lvsy/wHu+3BoSGCbBAcpTsTg=
 github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
+github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
+github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
 github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
 github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg=
 github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
@@ -249,39 +192,65 @@ github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9dec
 github.com/yuin/goldmark v1.3.5/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1Zlc8k=
 github.com/yuin/goldmark v1.4.1/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1Zlc8k=
 github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
+go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=
+go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y=
+go.opentelemetry.io/otel v1.41.0 h1:YlEwVsGAlCvczDILpUXpIpPSL/VPugt7zHThEMLce1c=
+go.opentelemetry.io/otel v1.41.0/go.mod h1:Yt4UwgEKeT05QbLwbyHXEwhnjxNO6D8L5PQP51/46dE=
+go.opentelemetry.io/otel/metric v1.41.0 h1:rFnDcs4gRzBcsO9tS8LCpgR0dxg4aaxWlJxCno7JlTQ=
+go.opentelemetry.io/otel/metric v1.41.0/go.mod h1:xPvCwd9pU0VN8tPZYzDZV/BMj9CM9vs00GuBjeKhJps=
+go.opentelemetry.io/otel/sdk v1.40.0 h1:KHW/jUzgo6wsPh9At46+h4upjtccTmuZCFAc9OJ71f8=
+go.opentelemetry.io/otel/sdk v1.40.0/go.mod h1:Ph7EFdYvxq72Y8Li9q8KebuYUr2KoeyHx0DRMKrYBUE=
+go.opentelemetry.io/otel/sdk/metric v1.39.0 h1:cXMVVFVgsIf2YL6QkRF4Urbr/aMInf+2WKg+sEJTtB8=
+go.opentelemetry.io/otel/sdk/metric v1.39.0/go.mod h1:xq9HEVH7qeX69/JnwEfp6fVq5wosJsY1mt4lLfYdVew=
+go.opentelemetry.io/otel/trace v1.41.0 h1:Vbk2co6bhj8L59ZJ6/xFTskY+tGAbOnCtQGVVa9TIN0=
+go.opentelemetry.io/otel/trace v1.41.0/go.mod h1:U1NU4ULCoxeDKc09yCWdWe+3QoyweJcISEVa1RBzOis=
+go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
+go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
+go.yaml.in/yaml/v2 v2.4.2/go.mod h1:081UH+NErpNdqlCXm3TtEran0rJZGxAYx9hb/ELlsPU=
+go.yaml.in/yaml/v2 v2.4.3 h1:6gvOSjQoTB3vt1l+CU+tSyi/HOjfOjRLJ4YwYZGwRO0=
+go.yaml.in/yaml/v2 v2.4.3/go.mod h1:zSxWcmIDjOzPXpjlTTbAsKokqkDNAVtZO0WOMiT90s8=
+go.yaml.in/yaml/v3 v3.0.3/go.mod h1:tBHosrYAkRZjRAOREWbDnBXUf08JOwYq++0QNwQiWzI=
+go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
+go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
-golang.org/x/crypto v0.1.0/go.mod h1:RecgLatLF4+eUMCP1PoPZQb+cVrJcOPbHkTkbkB9sbw=
-golang.org/x/crypto v0.11.0/go.mod h1:xgJhtzW8F9jGdVFWZESrid1U1bjeNy4zgy5cRr/CIio=
-golang.org/x/crypto v0.12.0/go.mod h1:NF0Gs7EO5K4qLn+Ylc+fih8BSTeIjAP05siRnAh98yw=
 golang.org/x/crypto v0.13.0/go.mod h1:y6Z2r+Rw4iayiXXAIxJIDAJ1zMW4yaTpebo8fPOliYc=
-golang.org/x/crypto v0.14.0/go.mod h1:MVFd36DqK4CsrnJYDkBA3VC4m2GkXAM0PvzMCn4JQf4=
 golang.org/x/crypto v0.16.0/go.mod h1:gCAAfMLgwOJRpTjQ2zCCt2OcSfYMTeZVSRtQlPC7Nq4=
-golang.org/x/crypto v0.18.0/go.mod h1:R0j02AL6hcrfOiy9T4ZYp/rcWeMxM3L6QYxlOuEG1mg=
 golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU=
-golang.org/x/crypto v0.21.0/go.mod h1:0BP7YvVV9gBbVKyeTG0Gyn+gZm94bibOW5BjDEYAOMs=
-golang.org/x/crypto v0.22.0/go.mod h1:vr6Su+7cTlO45qkww3VDJlzDn0ctJvRgYbC2NvXHt+M=
 golang.org/x/crypto v0.23.0/go.mod h1:CKFgDieR+mRhux2Lsu27y0fO304Db0wZe70UKqHu0v8=
-golang.org/x/crypto v0.24.0/go.mod h1:Z1PMYSOR5nyMcyAVAIQSKCDwalqy85Aqn1x3Ws4L5DM=
-golang.org/x/exp v0.0.0-20230515195305-f3d0a9c9a5cc h1:mCRnTeVUjcrhlRmO0VK8a6k6Rrf6TF9htwo2pJVSjIU=
-golang.org/x/exp v0.0.0-20230515195305-f3d0a9c9a5cc/go.mod h1:V1LtkGg67GoY2N1AnLN78QLrzxkLyJw7RJb1gzOOz9w=
+golang.org/x/crypto v0.28.0/go.mod h1:rmgy+3RHxRZMyY0jjAJShp2zgEdOqj2AO7U0pYmeQ7U=
+golang.org/x/crypto v0.38.0/go.mod h1:MvrbAqul58NNYPKnOra203SB9vpuZW0e+RRZV+Ggqjw=
+golang.org/x/crypto v0.39.0/go.mod h1:L+Xg3Wf6HoL4Bn4238Z6ft6KfEpN0tJGo53AAPC632U=
+golang.org/x/crypto v0.40.0/go.mod h1:Qr1vMER5WyS2dfPHAlsOj01wgLbsyWtFn/aY+5+ZdxY=
+golang.org/x/crypto v0.41.0/go.mod h1:pO5AFd7FA68rFak7rOAGVuygIISepHftHnr8dr6+sUc=
+golang.org/x/crypto v0.42.0/go.mod h1:4+rDnOTJhQCx2q7/j6rAN5XDw8kPjeaXEUR2eL94ix8=
+golang.org/x/crypto v0.43.0/go.mod h1:BFbav4mRNlXJL4wNeejLpWxB7wMbc79PdRGhWKncxR0=
+golang.org/x/crypto v0.44.0/go.mod h1:013i+Nw79BMiQiMsOPcVCB5ZIJbYkerPrGnOa00tvmc=
+golang.org/x/crypto v0.46.0/go.mod h1:Evb/oLKmMraqjZ2iQTwDwvCtJkczlDuTmdJXoZVzqU0=
+golang.org/x/crypto v0.47.0/go.mod h1:ff3Y9VzzKbwSSEzWqJsJVBnWmRwRSHt/6Op5n9bQc4A=
 golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.4.2/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.5.1/go.mod h1:5OXOZSfqPIIbmVBIIKWRFfZjPR0E5r58TLhUjH0a2Ro=
-golang.org/x/mod v0.6.0-dev.0.20220106191415-9b9b3d81d5e3/go.mod h1:3p9vT2HGsQu2K1YbXdKPJLVgG5VJdoTa1poYQBtP1AY=
 golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
-golang.org/x/mod v0.6.0/go.mod h1:4mET923SAdbXp2ki8ey+zGs1SLqsuM2Y0uvdZR/fUNI=
-golang.org/x/mod v0.7.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.9.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
-golang.org/x/mod v0.10.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.14.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
 golang.org/x/mod v0.15.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
 golang.org/x/mod v0.17.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
+golang.org/x/mod v0.21.0/go.mod h1:6SkKJ3Xj0I0BrPOZoBy3bdMptDDU9oJrpohJ3eWZ1fY=
+golang.org/x/mod v0.24.0/go.mod h1:IXM97Txy2VM4PJ3gI61r1YEk/gAj6zAHN3AdZt6S9Ww=
+golang.org/x/mod v0.25.0/go.mod h1:IXM97Txy2VM4PJ3gI61r1YEk/gAj6zAHN3AdZt6S9Ww=
+golang.org/x/mod v0.26.0/go.mod h1:/j6NAhSk8iQ723BGAUyoAcn7SlD7s15Dp9Nd/SfeaFQ=
+golang.org/x/mod v0.27.0/go.mod h1:rWI627Fq0DEoudcK+MBkNkCe0EetEaDSwJJkCcjpazc=
+golang.org/x/mod v0.28.0/go.mod h1:yfB/L0NOf/kmEbXjzCPOx1iK1fRutOydrCMsqRhEBxI=
+golang.org/x/mod v0.29.0/go.mod h1:NyhrlYXJ2H4eJiRy/WDBO6HMqZQ6q9nk4JzS3NuCK+w=
+golang.org/x/mod v0.30.0/go.mod h1:lAsf5O2EvJeSFMiBxXDki7sCgAxEUcZHXoXMKT4GJKc=
+golang.org/x/mod v0.31.0/go.mod h1:43JraMp9cGx1Rx3AqioxrbrhNsLl2l/iNAvuBkrezpg=
+golang.org/x/mod v0.32.0/go.mod h1:SgipZ/3h2Ci89DlEtEXWUk/HteuRin+HHhN+WbNhguU=
 golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
@@ -295,32 +264,28 @@ golang.org/x/net v0.0.0-20210421230115-4e50805a0758/go.mod h1:72T/g9IO56b78aLF+1
 golang.org/x/net v0.0.0-20210428140749-89ef3d95e781/go.mod h1:OJAsFXCWl8Ukc7SiCT/9KSuxbyM7479/AVlXFRxuMCk=
 golang.org/x/net v0.0.0-20211015210444-4f30a5c0130f/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20220127200216-cd36cc0744dd/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
-golang.org/x/net v0.0.0-20220225172249-27dd8689420f/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
-golang.org/x/net v0.0.0-20220425223048-2871e0cb64e4/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
 golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
-golang.org/x/net v0.1.0/go.mod h1:Cx3nUiGt4eDBEyega/BKRp+/AlGL8hYe7U9odMt2Cco=
-golang.org/x/net v0.2.0/go.mod h1:KqCZLdyyvdV855qA2rE3GC2aiw5xGR5TEjj8smXukLY=
-golang.org/x/net v0.3.0/go.mod h1:MBQ8lrhLObU/6UmLb4fmbmk5OcyYmqtbGd/9yIeKjEE=
-golang.org/x/net v0.5.0/go.mod h1:DivGGAXEgPSlEBzxGzZI+ZLohi+xUj054jfeKui00ws=
 golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
-golang.org/x/net v0.7.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
-golang.org/x/net v0.8.0/go.mod h1:QVkue5JL9kW//ek3r6jTKnTFis1tRmNAW2P1shuFdJc=
 golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
-golang.org/x/net v0.12.0/go.mod h1:zEVYFnQC7m/vmpQFELhcD1EWkZlX69l4oqgmer6hfKA=
-golang.org/x/net v0.14.0/go.mod h1:PpSgVXXLK0OxS0F31C1/tv6XNguvCrnXIDrFMspZIUI=
 golang.org/x/net v0.15.0/go.mod h1:idbUs1IY1+zTqbi8yxTbhexhEEk5ur9LInksu6HrEpk=
-golang.org/x/net v0.17.0/go.mod h1:NxSsAGuq816PNPmqtQdLE42eU2Fs7NoRIZrHJAlaCOE=
 golang.org/x/net v0.19.0/go.mod h1:CfAk/cbD4CthTvqiEl8NpboMuiuOYsAr/7NOjZJtv1U=
-golang.org/x/net v0.20.0/go.mod h1:z8BVo6PvndSri0LbOE3hAn0apkU+1YvI6E70E9jsnvY=
 golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44=
-golang.org/x/net v0.23.0/go.mod h1:JKghWKKOSdJwpW2GEx0Ja7fmaKnMsbu+MWVZTokSYmg=
-golang.org/x/net v0.24.0/go.mod h1:2Q7sJY5mzlzWjKtYUEXSlBWCdyaioyXzRB2RtU8KVE8=
 golang.org/x/net v0.25.0/go.mod h1:JkAGAh7GEvH74S6FOH42FLoXpXbE/aqXSrIQjXgsiwM=
-golang.org/x/net v0.26.0/go.mod h1:5YKkiSynbBIh3p6iOc/vibscux0x38BZDkn8sCUPxHE=
-golang.org/x/net v0.33.0 h1:74SYHlV8BIgHIFC/LrYkOGIwL19eTYXQ5wc6TBuO36I=
-golang.org/x/net v0.33.0/go.mod h1:HXLR5J+9DxmrqMwG9qjGCxZ+zKXxBru04zlTvWlWuN4=
-golang.org/x/oauth2 v0.21.0 h1:tsimM75w1tF/uws5rbeHzIWxEqElMehnc+iW793zsZs=
-golang.org/x/oauth2 v0.21.0/go.mod h1:XYTD2NtWslqkgxebSiOHnXEap4TF09sJSc7H1sXbhtI=
+golang.org/x/net v0.30.0/go.mod h1:2wGyMJ5iFasEhkwi13ChkO/t1ECNC4X4eBKkVFyYFlU=
+golang.org/x/net v0.40.0/go.mod h1:y0hY0exeL2Pku80/zKK7tpntoX23cqL3Oa6njdgRtds=
+golang.org/x/net v0.41.0/go.mod h1:B/K4NNqkfmg07DQYrbwvSluqCJOOXwUjeb/5lOisjbA=
+golang.org/x/net v0.42.0/go.mod h1:FF1RA5d3u7nAYA4z2TkclSCKh68eSXtiFwcWQpPXdt8=
+golang.org/x/net v0.43.0/go.mod h1:vhO1fvI4dGsIjh73sWfUVjj3N7CA9WkKJNQm2svM6Jg=
+golang.org/x/net v0.44.0/go.mod h1:ECOoLqd5U3Lhyeyo/QDCEVQ4sNgYsqvCZ722XogGieY=
+golang.org/x/net v0.45.0/go.mod h1:ECOoLqd5U3Lhyeyo/QDCEVQ4sNgYsqvCZ722XogGieY=
+golang.org/x/net v0.46.0/go.mod h1:Q9BGdFy1y4nkUwiLvT5qtyhAnEHgnQ/zd8PfU6nc210=
+golang.org/x/net v0.47.0/go.mod h1:/jNxtkgq5yWUGYkaZGqo27cfGZ1c5Nen03aYrrKpVRU=
+golang.org/x/net v0.48.0/go.mod h1:+ndRgGjkh8FGtu1w1FGbEC31if4VrNVMuKTgcAAnQRY=
+golang.org/x/net v0.49.0/go.mod h1:/ysNB2EvaqvesRkuLAyjI1ycPZlQHM3q01F02UY/MV8=
+golang.org/x/net v0.53.0 h1:d+qAbo5L0orcWAr0a9JweQpjXF19LMXJE8Ey7hwOdUA=
+golang.org/x/net v0.53.0/go.mod h1:JvMuJH7rrdiCfbeHoo3fCQU24Lf5JJwT9W3sJFulfgs=
+golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=
+golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -328,11 +293,17 @@ golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJ
 golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.2.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.3.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y=
 golang.org/x/sync v0.5.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sync v0.6.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sync v0.7.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
+golang.org/x/sync v0.8.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
+golang.org/x/sync v0.14.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
+golang.org/x/sync v0.15.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
+golang.org/x/sync v0.16.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
+golang.org/x/sync v0.17.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
+golang.org/x/sync v0.18.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
+golang.org/x/sync v0.19.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
 golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -352,79 +323,78 @@ golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20211019181941-9d821ace8654/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20211216021012-1d35b9e2eb4e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220209214540-3681064d5158/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220310020820-b874c991c1a5/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220319134239-a9b59b0215f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220422013727-9388b58f7150/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.3.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.4.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.9.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.10.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.11.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.13.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.15.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/sys v0.16.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/sys v0.18.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/sys v0.19.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.20.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/sys v0.21.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/sys v0.28.0 h1:Fksou7UEQUWlKvIdsqzJmUmCX3cZuD2+P3XyyzwMhlA=
-golang.org/x/sys v0.28.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/telemetry v0.0.0-20240208230135-b75ee8823808/go.mod h1:KG1lNk5ZFNssSZLrpVb4sMXKMpGwGXOxSG3rnu2gZQQ=
+golang.org/x/sys v0.26.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.33.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
+golang.org/x/sys v0.34.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
+golang.org/x/sys v0.35.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
+golang.org/x/sys v0.36.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
+golang.org/x/sys v0.37.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
+golang.org/x/sys v0.38.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
+golang.org/x/sys v0.39.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
+golang.org/x/sys v0.40.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
+golang.org/x/sys v0.43.0 h1:Rlag2XtaFTxp19wS8MXlJwTvoh8ArU6ezoyFsMyCTNI=
+golang.org/x/sys v0.43.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
 golang.org/x/telemetry v0.0.0-20240228155512-f48c80bd79b2/go.mod h1:TeRTkGYfJXctD9OcfyVLyj2J3IxLnKwHJR8f4D8a3YE=
+golang.org/x/telemetry v0.0.0-20240521205824-bda55230c457/go.mod h1:pRgIJT+bRLFKnoM1ldnzKoxTIn14Yxz928LQRYYgIN0=
+golang.org/x/telemetry v0.0.0-20250710130107-8d8967aff50b/go.mod h1:4ZwOYna0/zsOKwuR5X/m0QFOJpSZvAxFfkQT+Erd9D4=
+golang.org/x/telemetry v0.0.0-20250807160809-1a19826ec488/go.mod h1:fGb/2+tgXXjhjHsTNdVEEMZNWA0quBnfrO+AfoDSAKw=
+golang.org/x/telemetry v0.0.0-20250908211612-aef8a434d053/go.mod h1:+nZKN+XVh4LCiA9DV3ywrzN4gumyCnKjau3NGb9SGoE=
+golang.org/x/telemetry v0.0.0-20251008203120-078029d740a8/go.mod h1:Pi4ztBfryZoJEkyFTI5/Ocsu2jXyDr6iSdgJiYE/uwE=
+golang.org/x/telemetry v0.0.0-20251111182119-bc8e575c7b54/go.mod h1:hKdjCMrbv9skySur+Nek8Hd0uJ0GuxJIoIX2payrIdQ=
+golang.org/x/telemetry v0.0.0-20251203150158-8fff8a5912fc/go.mod h1:hKdjCMrbv9skySur+Nek8Hd0uJ0GuxJIoIX2payrIdQ=
+golang.org/x/telemetry v0.0.0-20260109210033-bd525da824e2/go.mod h1:b7fPSJ0pKZ3ccUh8gnTONJxhn3c/PS6tyzQvyqw4iA8=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
-golang.org/x/term v0.1.0/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
-golang.org/x/term v0.2.0/go.mod h1:TVmDHMZPmdnySmBfhjOoOdhjzdE1h4u1VwSiw2l1Nuc=
-golang.org/x/term v0.3.0/go.mod h1:q750SLmJuPmVoN1blW3UFBPREJfb1KmY3vwxfr+nFDA=
-golang.org/x/term v0.4.0/go.mod h1:9P2UbLfCdcvo3p/nzKvsmas4TnlujnuoV9hGgYzW1lQ=
 golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
-golang.org/x/term v0.6.0/go.mod h1:m6U89DPEgQRMq3DNkDClhWw02AUbt2daBVO4cn4Hv9U=
 golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo=
-golang.org/x/term v0.10.0/go.mod h1:lpqdcUyK/oCiQxvxVrppt5ggO2KCZ5QblwqPnfZ6d5o=
-golang.org/x/term v0.11.0/go.mod h1:zC9APTIj3jG3FdV/Ons+XE1riIZXG4aZ4GTHiPZJPIU=
 golang.org/x/term v0.12.0/go.mod h1:owVbMEjm3cBLCHdkQu9b1opXd4ETQWc3BhuQGKgXgvU=
-golang.org/x/term v0.13.0/go.mod h1:LTmsnFJwVN6bCy1rVCoS+qHT1HhALEFxKncY3WNNh4U=
 golang.org/x/term v0.15.0/go.mod h1:BDl952bC7+uMoWR75FIrCDx79TPU9oHkTZ9yRbYOrX0=
-golang.org/x/term v0.16.0/go.mod h1:yn7UURbUtPyrVJPGPq404EukNFxcm/foM+bV/bfcDsY=
 golang.org/x/term v0.17.0/go.mod h1:lLRBjIVuehSbZlaOtGMbcMncT+aqLLLmKrsjNrUguwk=
-golang.org/x/term v0.18.0/go.mod h1:ILwASektA3OnRv7amZ1xhE/KTR+u50pbXfZ03+6Nx58=
-golang.org/x/term v0.19.0/go.mod h1:2CuTdWZ7KHSQwUzKva0cbMg6q2DMI3Mmxp+gKJbskEk=
 golang.org/x/term v0.20.0/go.mod h1:8UkIAJTvZgivsXaD6/pH6U9ecQzZ45awqEOzuCvwpFY=
-golang.org/x/term v0.21.0/go.mod h1:ooXLefLobQVslOqselCNF4SxFAaoS6KujMbsGzSDmX0=
-golang.org/x/term v0.27.0 h1:WP60Sv1nlK1T6SupCHbXzSaN0b9wUmsPoRS9b61A23Q=
-golang.org/x/term v0.27.0/go.mod h1:iMsnZpn0cago0GOrHO2+Y7u7JPn5AylBrcoWkElMTSM=
+golang.org/x/term v0.25.0/go.mod h1:RPyXicDX+6vLxogjjRxjgD2TKtmAO6NZBsBRfrOLu7M=
+golang.org/x/term v0.32.0/go.mod h1:uZG1FhGx848Sqfsq4/DlJr3xGGsYMu/L5GW4abiaEPQ=
+golang.org/x/term v0.33.0/go.mod h1:s18+ql9tYWp1IfpV9DmCtQDDSRBUjKaw9M1eAv5UeF0=
+golang.org/x/term v0.34.0/go.mod h1:5jC53AEywhIVebHgPVeg0mj8OD3VO9OzclacVrqpaAw=
+golang.org/x/term v0.35.0/go.mod h1:TPGtkTLesOwf2DE8CgVYiZinHAOuy5AYUYT1lENIZnA=
+golang.org/x/term v0.36.0/go.mod h1:Qu394IJq6V6dCBRgwqshf3mPF85AqzYEzofzRdZkWss=
+golang.org/x/term v0.37.0/go.mod h1:5pB4lxRNYYVZuTLmy8oR2BH8dflOR+IbTYFD8fi3254=
+golang.org/x/term v0.38.0/go.mod h1:bSEAKrOT1W+VSu9TSCMtoGEOUcKxOKgl3LE5QEF/xVg=
+golang.org/x/term v0.39.0/go.mod h1:yxzUCTP/U+FzoxfdKmLaA0RV1WgE0VY7hXBwKtY/4ww=
+golang.org/x/term v0.42.0 h1:UiKe+zDFmJobeJ5ggPwOshJIVt6/Ft0rcfrXZDLWAWY=
+golang.org/x/term v0.42.0/go.mod h1:Dq/D+snpsbazcBG5+F9Q1n2rXV8Ma+71xEjTRufARgY=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.5/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
-golang.org/x/text v0.4.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
-golang.org/x/text v0.5.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
-golang.org/x/text v0.6.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
 golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
-golang.org/x/text v0.8.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
 golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
-golang.org/x/text v0.11.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
-golang.org/x/text v0.12.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
 golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
 golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/text v0.15.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
-golang.org/x/text v0.16.0/go.mod h1:GhwF1Be+LQoKShO3cGOHzqOgRrGaYc9AvblQOmPVHnI=
-golang.org/x/text v0.21.0 h1:zyQAAkrwaneQ066sspRyJaG9VNi/YJ1NfzcGB3hZ/qo=
-golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ=
-golang.org/x/time v0.3.0 h1:rg5rLMjNzMS1RkNLzCG38eapWhnYLFYXDXj2gOlr8j4=
-golang.org/x/time v0.3.0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
+golang.org/x/text v0.19.0/go.mod h1:BuEKDfySbSR4drPmRPG/7iBdf8hvFMuRexcpahXilzY=
+golang.org/x/text v0.25.0/go.mod h1:WEdwpYrmk1qmdHvhkSTNPm3app7v4rsT8F2UD6+VHIA=
+golang.org/x/text v0.26.0/go.mod h1:QK15LZJUUQVJxhz7wXgxSy/CJaTFjd0G+YLonydOVQA=
+golang.org/x/text v0.27.0/go.mod h1:1D28KMCvyooCX9hBiosv5Tz/+YLxj0j7XhWjpSUF7CU=
+golang.org/x/text v0.28.0/go.mod h1:U8nCwOR8jO/marOQ0QbDiOngZVEBB7MAiitBuMjXiNU=
+golang.org/x/text v0.29.0/go.mod h1:7MhJOA9CD2qZyOKYazxdYMF85OwPdEr9jTtBpO7ydH4=
+golang.org/x/text v0.30.0/go.mod h1:yDdHFIX9t+tORqspjENWgzaCVXgk0yYnYuSZ8UzzBVM=
+golang.org/x/text v0.31.0/go.mod h1:tKRAlv61yKIjGGHX/4tP1LTbc13YSec1pxVEWXzfoeM=
+golang.org/x/text v0.32.0/go.mod h1:o/rUWzghvpD5TXrTIBuJU77MTaN0ljMWE47kxGJQ7jY=
+golang.org/x/text v0.33.0/go.mod h1:LuMebE6+rBincTi9+xWTY8TztLzKHc/9C1uBCG27+q8=
+golang.org/x/text v0.36.0 h1:JfKh3XmcRPqZPKevfXVpI1wXPTqbkE5f7JA92a55Yxg=
+golang.org/x/text v0.36.0/go.mod h1:NIdBknypM8iqVmPiuco0Dh6P5Jcdk8lJL0CUebqK164=
+golang.org/x/time v0.14.0 h1:MRx4UaLrDotUKUdCIqzPC48t1Y9hANFKIRpNx+Te8PI=
+golang.org/x/time v0.14.0/go.mod h1:eL/Oa2bBBK0TkX57Fyni+NgnyQQN4LitPmob2Hjnqw4=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20200505023115-26f46d2f7ef8/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
@@ -434,32 +404,37 @@ golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4f
 golang.org/x/tools v0.1.1/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
 golang.org/x/tools v0.1.5/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
 golang.org/x/tools v0.1.9/go.mod h1:nABZi5QlRsZVlzPpHl034qft6wpY4eDcsTt5AaioBiU=
-golang.org/x/tools v0.1.10/go.mod h1:Uh6Zz+xoGYZom868N8YTex3t7RhtHDBrE8Gzo9bV56E=
 golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
-golang.org/x/tools v0.2.0/go.mod h1:y4OqIKeOV/fWJetJ8bXPU1sEVniLMIyDAZWeHdV+NTA=
-golang.org/x/tools v0.4.0/go.mod h1:UE5sM2OK9E/d67R0ANs2xJizIymRP5gJU295PvKXxjQ=
 golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
-golang.org/x/tools v0.7.0/go.mod h1:4pg6aUX35JBAogB10C9AtvVL+qowtN4pT3CGSQex14s=
-golang.org/x/tools v0.9.1/go.mod h1:owI94Op576fPu3cIGQeHs3joujW/2Oc6MtlxbF5dfNc=
-golang.org/x/tools v0.9.3/go.mod h1:owI94Op576fPu3cIGQeHs3joujW/2Oc6MtlxbF5dfNc=
-golang.org/x/tools v0.12.0/go.mod h1:Sc0INKfu04TlqNoRA1hgpFZbhYXHPr4V5DzpSBTPqQM=
 golang.org/x/tools v0.13.0/go.mod h1:HvlwmtVNQAhOuCjW7xxvovg8wbNq7LwfXh/k7wXUl58=
 golang.org/x/tools v0.16.1/go.mod h1:kYVVN6I1mBNoB1OX+noeBjbRk4IUEPa7JJ+TJMEooJ0=
-golang.org/x/tools v0.17.0/go.mod h1:xsh6VxdV005rRVaS6SSAf9oiAqljS7UZUacMZ8Bnsps=
-golang.org/x/tools v0.18.0/go.mod h1:GL7B4CwcLLeo59yx/9UWWuNOW1n3VZ4f5axWfML7Lcg=
-golang.org/x/tools v0.20.0/go.mod h1:WvitBU7JJf6A4jOdg4S1tviW9bhUxkgeCui/0JHctQg=
-golang.org/x/tools v0.21.0/go.mod h1:aiJjzUbINMkxbQROHiO6hDPo2LHcIPhhQsa9DLh0yGk=
-golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d h1:vU5i/LfpvrRCpgM/VPfJLg5KjxD3E+hfT1SH+d9zLwg=
 golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d/go.mod h1:aiJjzUbINMkxbQROHiO6hDPo2LHcIPhhQsa9DLh0yGk=
+golang.org/x/tools v0.26.0/go.mod h1:TPVVj70c7JJ3WCazhD8OdXcZg/og+b9+tH/KxylGwH0=
+golang.org/x/tools v0.33.0/go.mod h1:CIJMaWEY88juyUfo7UbgPqbC8rU2OqfAV1h2Qp0oMYI=
+golang.org/x/tools v0.34.0/go.mod h1:pAP9OwEaY1CAW3HOmg3hLZC5Z0CCmzjAF2UQMSqNARg=
+golang.org/x/tools v0.34.1-0.20250613162507-3f93fece84c7/go.mod h1:pAP9OwEaY1CAW3HOmg3hLZC5Z0CCmzjAF2UQMSqNARg=
+golang.org/x/tools v0.35.0/go.mod h1:NKdj5HkL/73byiZSJjqJgKn3ep7KjFkBOkR/Hps3VPw=
+golang.org/x/tools v0.36.0/go.mod h1:WBDiHKJK8YgLHlcQPYQzNCkUxUypCaa5ZegCVutKm+s=
+golang.org/x/tools v0.37.0/go.mod h1:MBN5QPQtLMHVdvsbtarmTNukZDdgwdwlO5qGacAzF0w=
+golang.org/x/tools v0.38.0/go.mod h1:yEsQ/d/YK8cjh0L6rZlY8tgtlKiBNTL14pGDJPJpYQs=
+golang.org/x/tools v0.39.0/go.mod h1:JnefbkDPyD8UU2kI5fuf8ZX4/yUeh9W877ZeBONxUqQ=
+golang.org/x/tools v0.40.0/go.mod h1:Ik/tzLRlbscWpqqMRjyWYDisX8bG13FrdXp3o4Sr9lc=
+golang.org/x/tools v0.41.0/go.mod h1:XSY6eDqxVNiYgezAVqqCeihT4j1U2CCsqvH3WhQpnlg=
+golang.org/x/tools v0.43.0 h1:12BdW9CeB3Z+J/I/wj34VMl8X+fEXBxVR90JeMX5E7s=
+golang.org/x/tools v0.43.0/go.mod h1:uHkMso649BX2cZK6+RpuIPXS3ho2hZo4FVwfoy1vIk0=
+golang.org/x/tools/go/expect v0.1.0-deprecated/go.mod h1:eihoPOH+FgIqa3FpoTwguz/bVUSGBlGQU67vpBeOrBY=
+golang.org/x/tools/go/expect v0.1.1-deprecated/go.mod h1:eihoPOH+FgIqa3FpoTwguz/bVUSGBlGQU67vpBeOrBY=
+golang.org/x/tools/go/packages/packagestest v0.1.1-deprecated/go.mod h1:RVAQXBGNv1ib0J382/DPCRS/BPnsGebyM1Gj5VSDpG8=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2/go.mod h1:K8+ghG5WaK9qNqU5K3HdILfMLy1f3aNYFI/wnl100a8=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20240701130421-f6361c86f094 h1:BwIjyKYGsK9dMCBOorzRri8MQwmi7mT9rGHsCEinZkA=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20240701130421-f6361c86f094/go.mod h1:Ue6ibwXGpU+dqIcODieyLOcgj7z8+IcskoNIgZxtrFY=
-google.golang.org/grpc v1.65.0 h1:bs/cUb4lp1G5iImFFd3u5ixQzweKizoZJAwBNLR42lc=
-google.golang.org/grpc v1.65.0/go.mod h1:WgYC2ypjlB0EiQi6wdKixMqukr6lBc0Vo+oOgjrM5ZQ=
+gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4=
+gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260128011058-8636f8732409 h1:H86B94AW+VfJWDqFeEbBPhEtHzJwJfTbgE2lZa54ZAQ=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260128011058-8636f8732409/go.mod h1:j9x/tPzZkyxcgEFkiKEEGxfvyumM01BEtsW8xzOahRQ=
+google.golang.org/grpc v1.80.0 h1:Xr6m2WmWZLETvUNvIUmeD5OAagMw3FiKmMlTdViWsHM=
+google.golang.org/grpc v1.80.0/go.mod h1:ho/dLnxwi3EDJA4Zghp7k2Ec1+c2jqup0bFkw07bwF4=
 google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
 google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
 google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=
@@ -469,18 +444,17 @@ google.golang.org/protobuf v1.23.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2
 google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
 google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
 google.golang.org/protobuf v1.27.1/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
-google.golang.org/protobuf v1.28.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
-google.golang.org/protobuf v1.33.0/go.mod h1:c6P6GXX6sHbq/GpV6MGZEdwhWPcYBgnhAHhKbcUYpos=
-google.golang.org/protobuf v1.34.2 h1:6xV6lTsCfpGD21XK49h7MhtcApnLqkfYgPcdHftf6hg=
-google.golang.org/protobuf v1.34.2/go.mod h1:qYOHts0dSfpeUzUFpOMr/WGzszTmLH+DiWniOlNbLDw=
+google.golang.org/protobuf v1.35.1/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE=
+google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af h1:+5/Sw3GsDNlEmu7TfklWKPdQ0Ykja5VEmq2i817+jbI=
+google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20200227125254-8fa46927fb4f/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
-gopkg.in/evanphx/json-patch.v4 v4.12.0 h1:n6jtcsulIzXPJaxegRbvFNNrZDjbij7ny3gmSPG+6V4=
-gopkg.in/evanphx/json-patch.v4 v4.12.0/go.mod h1:p8EYWUEYMpynmqDbY58zCKCFZw8pRWMG4EsWvDvM72M=
+gopkg.in/evanphx/json-patch.v4 v4.13.0 h1:czT3CmqEaQ1aanPc5SdlgQrrEIb8w/wwCvWWnfEbYzo=
+gopkg.in/evanphx/json-patch.v4 v4.13.0/go.mod h1:p8EYWUEYMpynmqDbY58zCKCFZw8pRWMG4EsWvDvM72M=
 gopkg.in/fsnotify.v1 v1.4.7/go.mod h1:Tz8NjZHkW78fSQdbUxIjBTcgA1z1m8ZHf0WmKUhAMys=
 gopkg.in/inf.v0 v0.9.1 h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc=
 gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
@@ -497,47 +471,54 @@ gopkg.in/yaml.v3 v3.0.0-20200615113413-eeeca48fe776/go.mod h1:K4uyk7z7BCEPqu6E+C
 gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-k8s.io/api v0.31.4 h1:I2QNzitPVsPeLQvexMEsj945QumYraqv9m74isPDKhM=
-k8s.io/api v0.31.4/go.mod h1:d+7vgXLvmcdT1BCo79VEgJxHHryww3V5np2OYTr6jdw=
-k8s.io/apiextensions-apiserver v0.31.4 h1:FxbqzSvy92Ca9DIs5jqot883G0Ln/PGXfm/07t39LS0=
-k8s.io/apiextensions-apiserver v0.31.4/go.mod h1:hIW9YU8UsqZqIWGG99/gsdIU0Ar45Qd3A12QOe/rvpg=
-k8s.io/apimachinery v0.31.4 h1:8xjE2C4CzhYVm9DGf60yohpNUh5AEBnPxCryPBECmlM=
-k8s.io/apimachinery v0.31.4/go.mod h1:rsPdaZJfTfLsNJSQzNHQvYoTmxhoOEofxtOsF3rtsMo=
-k8s.io/client-go v0.31.4 h1:t4QEXt4jgHIkKKlx06+W3+1JOwAFU/2OPiOo7H92eRQ=
-k8s.io/client-go v0.31.4/go.mod h1:kvuMro4sFYIa8sulL5Gi5GFqUPvfH2O/dXuKstbaaeg=
-k8s.io/code-generator v0.31.4/go.mod h1:yMDt13Kn7m4MMZ4LxB1KBzdZjEyxzdT4b4qXq+lnI90=
+k8s.io/api v0.36.0 h1:SgqDhZzHdOtMk40xVSvCXkP9ME0H05hPM3p9AB1kL80=
+k8s.io/api v0.36.0/go.mod h1:m1LVrGPNYax5NBHdO+QuAedXyuzTt4RryI/qnmNvs34=
+k8s.io/apiextensions-apiserver v0.36.0 h1:Wt7E8J+VBCbj4FjiBfDTK/neXDDjyJVJc7xfuOHImZ0=
+k8s.io/apiextensions-apiserver v0.36.0/go.mod h1:kGDjH0msuiIB3tgsYRV0kS9GqpMYMUsQ3GHv7TApyug=
+k8s.io/apimachinery v0.36.0 h1:jZyPzhd5Z+3h9vJLt0z9XdzW9VzNzWAUw+P1xZ9PXtQ=
+k8s.io/apimachinery v0.36.0/go.mod h1:FklypaRJt6n5wUIwWXIP6GJlIpUizTgfo1T/As+Tyxc=
+k8s.io/client-go v0.36.0 h1:pOYi7C4RHChYjMiHpZSpSbIM6ZxVbRXBy7CuiIwqA3c=
+k8s.io/client-go v0.36.0/go.mod h1:ZKKcpwF0aLYfkHFCjillCKaTK/yBkEDHTDXCFY6AS9Y=
+k8s.io/code-generator v0.36.0/go.mod h1:Tr2UhfBRdlyRoadfob9aPCmmGe8PUs5XPK9MEJ2nx+w=
 k8s.io/gengo v0.0.0-20210813121822-485abfe95c7c/go.mod h1:FiNAH4ZV3gBg2Kwh89tzAEV2be7d5xI0vBa/VySYy3E=
 k8s.io/gengo v0.0.0-20211129171323-c02415ce4185/go.mod h1:FiNAH4ZV3gBg2Kwh89tzAEV2be7d5xI0vBa/VySYy3E=
-k8s.io/gengo/v2 v2.0.0-20240228010128-51d4e06bde70/go.mod h1:VH3AT8AaQOqiGjMF9p0/IM1Dj+82ZwjfxUP1IxaHE+8=
+k8s.io/gengo/v2 v2.0.0-20250604051438-85fd79dbfd9f/go.mod h1:EJykeLsmFC60UQbYJezXkEsG2FLrt0GPNkU5iK5GWxU=
+k8s.io/gengo/v2 v2.0.0-20250922181213-ec3ebc5fd46b/go.mod h1:CgujABENc3KuTrcsdpGmrrASjtQsWCT7R99mEV4U/fM=
 k8s.io/klog/v2 v2.0.0/go.mod h1:PBfzABfn139FHAV07az/IF9Wp1bkk3vpT2XSJ76fSDE=
 k8s.io/klog/v2 v2.2.0/go.mod h1:Od+F08eJP+W3HUb4pSrPpgp9DGU4GzlpG/TmITuYh/Y=
 k8s.io/klog/v2 v2.40.1/go.mod h1:y1WjHnz7Dj687irZUWR/WLkLc5N1YHtjLdmgWjndZn0=
 k8s.io/klog/v2 v2.80.1/go.mod h1:y1WjHnz7Dj687irZUWR/WLkLc5N1YHtjLdmgWjndZn0=
-k8s.io/klog/v2 v2.120.1/go.mod h1:3Jpz1GvMt720eyJH1ckRHK1EDfpxISzJ7I9OYgaDtPE=
-k8s.io/klog/v2 v2.130.1 h1:n9Xl7H1Xvksem4KFG4PYbdQCQxqc/tTUyrgXaOhHSzk=
 k8s.io/klog/v2 v2.130.1/go.mod h1:3Jpz1GvMt720eyJH1ckRHK1EDfpxISzJ7I9OYgaDtPE=
+k8s.io/klog/v2 v2.140.0 h1:Tf+J3AH7xnUzZyVVXhTgGhEKnFqye14aadWv7bzXdzc=
+k8s.io/klog/v2 v2.140.0/go.mod h1:o+/RWfJ6PwpnFn7OyAG3QnO47BFsymfEfrz6XyYSSp0=
 k8s.io/kube-openapi v0.0.0-20220124234850-424119656bbf/go.mod h1:sX9MT8g7NVZM5lVL/j8QyCCJe8YSMW30QvGZWaCIDIk=
-k8s.io/kube-openapi v0.0.0-20240228011516-70dd3763d340 h1:BZqlfIlq5YbRMFko6/PM7FjZpUb45WallggurYhKGag=
-k8s.io/kube-openapi v0.0.0-20240228011516-70dd3763d340/go.mod h1:yD4MZYeKMBwQKVht279WycxKyM84kkAx2DPrTXaeb98=
-k8s.io/mount-utils v0.31.4 h1:9aWJ5BpJvs6fdIo36wWIuCC6ZMNllUT0JSFsVNJloFI=
-k8s.io/mount-utils v0.31.4/go.mod h1:HV/VYBUGqYUj4vt82YltzpWvgv8FPg0G9ItyInT3NPU=
+k8s.io/kube-openapi v0.0.0-20260317180543-43fb72c5454a h1:xCeOEAOoGYl2jnJoHkC3hkbPJgdATINPMAxaynU2Ovg=
+k8s.io/kube-openapi v0.0.0-20260317180543-43fb72c5454a/go.mod h1:uGBT7iTA6c6MvqUvSXIaYZo9ukscABYi2btjhvgKGZ0=
+k8s.io/mount-utils v0.36.0 h1:ufsqGyCoPDh7p+6OIa1wv6oH9GqkQQ8XIfEOVfCV3g0=
+k8s.io/mount-utils v0.36.0/go.mod h1:+I47UOG6FiUGVSy7VanjU/mQXLShMo3M7xBpGLzCub8=
+k8s.io/streaming v0.36.0/go.mod h1:z6fV3D+NVkoeqRMtWwlUZK6U17SY/LqNzOxWL6GyR/s=
 k8s.io/utils v0.0.0-20210802155522-efc7438f0176/go.mod h1:jPW/WVKK9YHAvNhRxK0md/EJ228hCsBRufyofKtW8HA=
-k8s.io/utils v0.0.0-20230726121419-3b25d923346b/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
-k8s.io/utils v0.0.0-20240711033017-18e509b52bc8 h1:pUdcCO1Lk/tbT5ztQWOBi5HBgbBP1J8+AsQnQCKsi8A=
 k8s.io/utils v0.0.0-20240711033017-18e509b52bc8/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
+k8s.io/utils v0.0.0-20260210185600-b8788abfbbc2 h1:AZYQSJemyQB5eRxqcPky+/7EdBj0xi3g0ZcxxJ7vbWU=
+k8s.io/utils v0.0.0-20260210185600-b8788abfbbc2/go.mod h1:xDxuJ0whA3d0I4mf/C4ppKHxXynQ+fxnkmQH0vTHnuk=
 kubevirt.io/api v1.2.2 h1:PeA937vsZawmKAsiiDQZJ/BbGH4OhEWsIzWrCNfmYXk=
 kubevirt.io/api v1.2.2/go.mod h1:SbeR9ma4EwnaOZEUkh/lNz0kzYm5LPpEDE30vKXC5Zg=
 kubevirt.io/containerized-data-importer-api v1.59.0 h1:GdDt9BlR0qHejpMaPfASbsG8JWDmBf1s7xZBj5W9qn0=
 kubevirt.io/containerized-data-importer-api v1.59.0/go.mod h1:4yOGtCE7HvgKp7wftZZ3TBvDJ0x9d6N6KaRjRYcUFpE=
 kubevirt.io/controller-lifecycle-operator-sdk/api v0.0.0-20220329064328-f3cc58c6ed90 h1:QMrd0nKP0BGbnxTqakhDZAUhGKxPiPiN5gSDqKUmGGc=
 kubevirt.io/controller-lifecycle-operator-sdk/api v0.0.0-20220329064328-f3cc58c6ed90/go.mod h1:018lASpFYBsYN6XwmA2TIrPCx6e0gviTd/ZNtSitKgc=
-sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd h1:EDPBXCAspyGV4jQlpZSudPeMmr1bNJefnuqLsRAsHZo=
 sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd/go.mod h1:B8JuhiUyNFVKdsE8h686QcCxMaH6HrOAZj4vswFpcB0=
+sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 h1:IpInykpT6ceI+QxKBbEflcR5EXP7sU1kvOlxwZh5txg=
+sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730/go.mod h1:mdzfpAEoE6DHQEN0uh9ZbOCuHbLK5wOm7dK4ctXE9Tg=
+sigs.k8s.io/randfill v0.0.0-20250304075658-069ef1bbf016/go.mod h1:XeLlZ/jmk4i1HRopwe7/aU3H5n1zNUcX6TM94b3QxOY=
+sigs.k8s.io/randfill v1.0.0 h1:JfjMILfT8A6RbawdsK2JXGBR5AQVfd+9TbzrlneTyrU=
+sigs.k8s.io/randfill v1.0.0/go.mod h1:XeLlZ/jmk4i1HRopwe7/aU3H5n1zNUcX6TM94b3QxOY=
 sigs.k8s.io/structured-merge-diff/v4 v4.0.2/go.mod h1:bJZC9H9iH24zzfZ/41RGcq60oK1F7G282QMXDPYydCw=
-sigs.k8s.io/structured-merge-diff/v4 v4.2.3/go.mod h1:qjx8mGObPmV2aSZepjQjbmb2ihdVs8cGKBraizNC69E=
-sigs.k8s.io/structured-merge-diff/v4 v4.4.1 h1:150L+0vs/8DA78h1u02ooW1/fFq/Lwr+sGiqlzvrtq4=
-sigs.k8s.io/structured-merge-diff/v4 v4.4.1/go.mod h1:N8hJocpFajUSSeSJ9bOZ77VzejKZaXsTtZo4/u7Io08=
+sigs.k8s.io/structured-merge-diff/v6 v6.2.0/go.mod h1:M3W8sfWvn2HhQDIbGWj3S099YozAsymCo/wrT5ohRUE=
+sigs.k8s.io/structured-merge-diff/v6 v6.3.2 h1:kwVWMx5yS1CrnFWA/2QHyRVJ8jM6dBA80uLmm0wJkk8=
+sigs.k8s.io/structured-merge-diff/v6 v6.3.2/go.mod h1:M3W8sfWvn2HhQDIbGWj3S099YozAsymCo/wrT5ohRUE=
 sigs.k8s.io/yaml v1.2.0/go.mod h1:yfXDCHCao9+ENCvLSE62v9VSji2MKu5jeNfTrofGhJc=
 sigs.k8s.io/yaml v1.3.0/go.mod h1:GeOyir5tyXNByN85N/dRIT9es5UQNerPYEKK56eTBm8=
-sigs.k8s.io/yaml v1.4.0 h1:Mk1wCc2gy/F0THH0TAp1QYyJNzRm2KCLy3o5ASXVI5E=
 sigs.k8s.io/yaml v1.4.0/go.mod h1:Ejl7/uTz7PSA4eKMyQCUTnhZYNmLIl+5c2lQPGR2BPY=
+sigs.k8s.io/yaml v1.6.0 h1:G8fkbMSAFqgEFgh4b1wmtzDnioxFCUgTZhlbj5P9QYs=
+sigs.k8s.io/yaml v1.6.0/go.mod h1:796bPqUfzR/0jLAl6XjHl3Ck7MiyVv8dbTdyT3/pMf4=
diff --git a/packages/apps/kubernetes/images/kubevirt-csi-driver/main.go b/packages/apps/kubernetes/images/kubevirt-csi-driver/main.go
index 396cee42..1b48bfb4 100644
--- a/packages/apps/kubernetes/images/kubevirt-csi-driver/main.go
+++ b/packages/apps/kubernetes/images/kubevirt-csi-driver/main.go
@@ -134,14 +134,19 @@ func handle() {
 	}
 
 	// Create upstream driver (provides Identity, Controller, Node services)
-	upstreamDriver := service.NewKubevirtCSIDriver(virtClient,
-		identityClientset,
-		*infraClusterNamespace,
-		infraClusterLabelsMap,
-		storageClassEnforcement,
-		nodeID,
-		*runNodeService,
-		*runControllerService)
+	upstreamDriver := service.NewKubevirtCSIDriver().
+		WithIdentityService(identityClientset)
+	if *runControllerService {
+		upstreamDriver = upstreamDriver.WithControllerService(
+			virtClient,
+			*infraClusterNamespace,
+			infraClusterLabelsMap,
+			storageClassEnforcement,
+		)
+	}
+	if *runNodeService {
+		upstreamDriver = upstreamDriver.WithNodeService(nodeID)
+	}
 
 	// Wrap controller and node services with NFS/RWX support
 	var cs csi.ControllerServer
diff --git a/packages/apps/kubernetes/templates/_helpers.tpl b/packages/apps/kubernetes/templates/_helpers.tpl
index 40a8ae7a..36c06b64 100644
--- a/packages/apps/kubernetes/templates/_helpers.tpl
+++ b/packages/apps/kubernetes/templates/_helpers.tpl
@@ -49,52 +49,3 @@ Selector labels
 app.kubernetes.io/name: {{ include "kubernetes.name" . }}
 app.kubernetes.io/instance: {{ .Release.Name }}
 {{- end }}
-
-{{/*
-wait-for-kubeconfig init container shared by the control-plane-side
-Deployments (cluster-autoscaler, kccm, kcsi-controller) that mount the
-*-admin-kubeconfig Secret provisioned asynchronously by Kamaji. The
-Secret volume is declared optional so kubelet does not FailedMount while
-Kamaji is still bootstrapping; this container polls the mounted path and
-exits only when super-admin.svc appears, which happens after kubelet's
-optional-Secret refresh cycle.
-
-The 10m deadline stays strictly below the 15m HelmRelease
-Install.Timeout set by cozystack-api for the Kubernetes kind (via the
-release.cozystack.io/helm-install-timeout annotation) so the
-CrashLoopBackOff surfaces before flux remediation fires and uninstalls
-the Cluster CR.
-
-The default image lives in images/busybox.tag and points directly at
-docker.io by digest (not mirrored to ghcr.io like the other .tag files
-here): the payload is a one-shot sh loop and the digest pin makes the
-pull immutable. Operators in air-gapped or rate-limited environments
-can override it via .Values.images.waitForKubeconfig (any registry
-reference kubelet can pull). When the value is empty the chart falls
-back to the bundled digest pin, preserving the prior default.
-
-Call site owns the surrounding volumes block; the kubeconfig volume
-must exist on the pod and mount at /etc/kubernetes/kubeconfig.
-*/}}
-{{- define "kubernetes.waitForAdminKubeconfig" -}}
-- name: wait-for-kubeconfig
-  image: "{{ default (.Files.Get "images/busybox.tag" | trim) .Values.images.waitForKubeconfig }}"
-  command:
-  - sh
-  - -c
-  - |
-    set -eu
-    deadline=$(( $(date +%s) + 600 ))
-    until [ -s /etc/kubernetes/kubeconfig/super-admin.svc ]; do
-      if [ "$(date +%s)" -ge "$deadline" ]; then
-        echo "admin kubeconfig was not provisioned within 10m; exiting so the pod goes CrashLoopBackOff and surfaces in dashboards" >&2
-        exit 1
-      fi
-      echo "waiting for admin kubeconfig (provisioned by Kamaji, visible after kubelet Secret refresh)..."
-      sleep 5
-    done
-  volumeMounts:
-  - name: kubeconfig
-    mountPath: /etc/kubernetes/kubeconfig
-    readOnly: true
-{{- end }}
diff --git a/packages/apps/kubernetes/templates/cluster-autoscaler/deployment.yaml b/packages/apps/kubernetes/templates/cluster-autoscaler/deployment.yaml
index 298d86db..a00e0155 100644
--- a/packages/apps/kubernetes/templates/cluster-autoscaler/deployment.yaml
+++ b/packages/apps/kubernetes/templates/cluster-autoscaler/deployment.yaml
@@ -1,14 +1,3 @@
-{{- /*
-  Gate the control-plane-side workloads on the parent tenant having an etcd
-  DataStore. Without it no KamajiControlPlane is ever created, Kamaji never
-  provisions -admin-kubeconfig, and rendering these Deployments would cause
-  the wait-for-kubeconfig init to CrashLoopBackOff indefinitely, consuming
-  the parent HelmRelease install timeout and triggering the very uninstall
-  remediation cycle this chart is supposed to avoid. Rendering them only
-  when $etcd is set keeps the HelmRelease Ready while flux retries on its
-  interval and picks up the DataStore as soon as the Tenant chart finishes.
-*/}}
-{{- if .Values._namespace.etcd }}
 ---
 apiVersion: apps/v1
 kind: Deployment
@@ -34,8 +23,6 @@ spec:
         - key: node-role.kubernetes.io/control-plane
           operator: Exists
           effect: "NoSchedule"
-      initContainers:
-      {{- include "kubernetes.waitForAdminKubeconfig" $ | nindent 6 }}
       containers:
       - image: "{{ $.Files.Get "images/cluster-autoscaler.tag" | trim }}"
         name: cluster-autoscaler
@@ -69,7 +56,6 @@ spec:
         name: cloud-config
       - secret:
           secretName: {{ .Release.Name }}-admin-kubeconfig
-          optional: true
         name: kubeconfig
       serviceAccountName: {{ .Release.Name }}-cluster-autoscaler
       terminationGracePeriodSeconds: 10
@@ -119,4 +105,3 @@ rules:
     - list
     - update
     - watch
-{{- end }}
diff --git a/packages/apps/kubernetes/templates/cluster.yaml b/packages/apps/kubernetes/templates/cluster.yaml
index e1494e64..10d6fd80 100644
--- a/packages/apps/kubernetes/templates/cluster.yaml
+++ b/packages/apps/kubernetes/templates/cluster.yaml
@@ -1,15 +1,4 @@
 {{- $etcd := .Values._namespace.etcd }}
-{{- /*
-  When $etcd is empty, the parent Tenant application has not populated
-  _namespace.etcd in cozystack-values yet - either the operator forgot to
-  set etcd: true on an ancestor Tenant, or the Tenant HelmRelease is still
-  reconciling. Either way, rendering a KamajiControlPlane with an empty
-  dataStoreName would be rejected by Kamaji's admission webhook and the
-  HelmRelease would fail to install, triggering remediation. Instead, emit
-  a single ConfigMap as a user-visible status beacon and skip the rest so
-  flux marks the HelmRelease Ready and retries its 5m reconcile loop until
-  the Tenant chart catches up.
-*/}}
 {{- $ingress := .Values._namespace.ingress }}
 {{- $host := .Values._namespace.host }}
 {{- $kubevirtmachinetemplateNames := list }}
@@ -95,26 +84,6 @@ spec:
           - name: default
             pod: {}
 {{- end }}
-{{- if not $etcd }}
----
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: {{ .Release.Name }}-awaiting-etcd
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/managed-by: {{ .Release.Service }}
-    app.kubernetes.io/name: kubernetes
-    app.kubernetes.io/instance: {{ .Release.Name }}
-data:
-  status: "awaiting-etcd"
-  message: |
-    No DataStore is available for this tenant Kubernetes cluster. The parent
-    Tenant application has not populated _namespace.etcd. Set spec.etcd: true
-    on an ancestor Tenant (usually tenant-root) and wait for its HelmRelease
-    to reconcile - this HelmRelease will pick up the DataStore on its next
-    5m reconcile loop and provision the cluster.
-{{- else }}
 ---
 apiVersion: cluster.x-k8s.io/v1beta1
 kind: Cluster
@@ -435,4 +404,3 @@ metadata:
 spec:
   {{- .spec | toYaml | nindent 2 }}
 {{- end }}
-{{- end }}
diff --git a/packages/apps/kubernetes/templates/csi/deploy.yaml b/packages/apps/kubernetes/templates/csi/deploy.yaml
index de62104c..938b6d67 100644
--- a/packages/apps/kubernetes/templates/csi/deploy.yaml
+++ b/packages/apps/kubernetes/templates/csi/deploy.yaml
@@ -1,4 +1,3 @@
-{{- if .Values._namespace.etcd }}
 kind: Deployment
 apiVersion: apps/v1
 metadata:
@@ -25,8 +24,6 @@ spec:
         - key: node-role.kubernetes.io/control-plane
           operator: Exists
           effect: "NoSchedule"
-      initContainers:
-      {{- include "kubernetes.waitForAdminKubeconfig" $ | nindent 6 }}
       containers:
         - name: csi-driver
           imagePullPolicy: Always
@@ -237,6 +234,4 @@ spec:
           emptyDir: {}
         - secret:
             secretName: {{ .Release.Name }}-admin-kubeconfig
-            optional: true
           name: kubeconfig
-{{- end }}
diff --git a/packages/apps/kubernetes/templates/helmreleases/cert-manager-crds.yaml b/packages/apps/kubernetes/templates/helmreleases/cert-manager-crds.yaml
index fd9dac7e..be07a8b9 100644
--- a/packages/apps/kubernetes/templates/helmreleases/cert-manager-crds.yaml
+++ b/packages/apps/kubernetes/templates/helmreleases/cert-manager-crds.yaml
@@ -1,4 +1,4 @@
-{{- if and .Values.addons.certManager.enabled .Values._namespace.etcd }}
+{{- if .Values.addons.certManager.enabled }}
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:
diff --git a/packages/apps/kubernetes/templates/helmreleases/cert-manager.yaml b/packages/apps/kubernetes/templates/helmreleases/cert-manager.yaml
index 700b666e..6857581a 100644
--- a/packages/apps/kubernetes/templates/helmreleases/cert-manager.yaml
+++ b/packages/apps/kubernetes/templates/helmreleases/cert-manager.yaml
@@ -8,7 +8,7 @@ cert-manager:
 {{- end }}
 {{- end }}
 
-{{- if and .Values.addons.certManager.enabled .Values._namespace.etcd }}
+{{- if .Values.addons.certManager.enabled }}
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:
diff --git a/packages/apps/kubernetes/templates/helmreleases/cilium.yaml b/packages/apps/kubernetes/templates/helmreleases/cilium.yaml
index d8c90cbf..d032f5b6 100644
--- a/packages/apps/kubernetes/templates/helmreleases/cilium.yaml
+++ b/packages/apps/kubernetes/templates/helmreleases/cilium.yaml
@@ -14,7 +14,6 @@ cilium:
   {{- end }}
 {{- end }}
 
-{{- if .Values._namespace.etcd }}
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:
@@ -56,4 +55,3 @@ spec:
   - name: {{ .Release.Name }}-gateway-api-crds
     namespace: {{ .Release.Namespace }}
   {{- end }}
-{{- end }}
diff --git a/packages/apps/kubernetes/templates/helmreleases/coredns.yaml b/packages/apps/kubernetes/templates/helmreleases/coredns.yaml
index 0711a51d..bdb6c682 100644
--- a/packages/apps/kubernetes/templates/helmreleases/coredns.yaml
+++ b/packages/apps/kubernetes/templates/helmreleases/coredns.yaml
@@ -4,7 +4,6 @@ coredns:
     clusterIP: "10.95.0.10"
 {{- end }}
 
-{{- if .Values._namespace.etcd }}
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:
@@ -43,4 +42,3 @@ spec:
   {{- end }}
   - name: {{ .Release.Name }}-cilium
     namespace: {{ .Release.Namespace }}
-{{- end }}
diff --git a/packages/apps/kubernetes/templates/helmreleases/csi.yaml b/packages/apps/kubernetes/templates/helmreleases/csi.yaml
index 109d78e1..dd2c69a6 100644
--- a/packages/apps/kubernetes/templates/helmreleases/csi.yaml
+++ b/packages/apps/kubernetes/templates/helmreleases/csi.yaml
@@ -1,4 +1,3 @@
-{{- if .Values._namespace.etcd }}
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:
@@ -40,4 +39,3 @@ spec:
   - name: {{ .Release.Name }}
     namespace: {{ .Release.Namespace }}
   {{- end }}
-{{- end }}
diff --git a/packages/apps/kubernetes/templates/helmreleases/fluxcd.yaml b/packages/apps/kubernetes/templates/helmreleases/fluxcd.yaml
index 25fff01c..76499dfe 100644
--- a/packages/apps/kubernetes/templates/helmreleases/fluxcd.yaml
+++ b/packages/apps/kubernetes/templates/helmreleases/fluxcd.yaml
@@ -1,4 +1,4 @@
-{{- if and .Values.addons.fluxcd.enabled .Values._namespace.etcd }}
+{{- if .Values.addons.fluxcd.enabled }}
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:
diff --git a/packages/apps/kubernetes/templates/helmreleases/gateway-api-crds.yaml b/packages/apps/kubernetes/templates/helmreleases/gateway-api-crds.yaml
index b4172ed1..2bcc8d4d 100644
--- a/packages/apps/kubernetes/templates/helmreleases/gateway-api-crds.yaml
+++ b/packages/apps/kubernetes/templates/helmreleases/gateway-api-crds.yaml
@@ -1,4 +1,4 @@
-{{- if and $.Values.addons.gatewayAPI.enabled $.Values._namespace.etcd }}
+{{- if $.Values.addons.gatewayAPI.enabled }}
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:
diff --git a/packages/apps/kubernetes/templates/helmreleases/gpu-operator.yaml b/packages/apps/kubernetes/templates/helmreleases/gpu-operator.yaml
index 655dc868..5ef48912 100644
--- a/packages/apps/kubernetes/templates/helmreleases/gpu-operator.yaml
+++ b/packages/apps/kubernetes/templates/helmreleases/gpu-operator.yaml
@@ -1,12 +1,4 @@
-{{- define "cozystack.defaultGpuOperatorValues" -}}
-{{- if .Values.addons.hami.enabled }}
-gpu-operator:
-  devicePlugin:
-    enabled: false
-{{- end }}
-{{- end }}
-
-{{- if and .Values.addons.gpuOperator.enabled .Values._namespace.etcd }}
+{{- if .Values.addons.gpuOperator.enabled }}
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:
@@ -37,12 +29,9 @@ spec:
     force: true
     remediation:
       retries: -1
-  {{- $defaults := fromYaml (include "cozystack.defaultGpuOperatorValues" .) }}
-  {{- $overrides := deepCopy (default (dict) .Values.addons.gpuOperator.valuesOverride) }}
-  {{- $merged := mergeOverwrite (default (dict) $defaults) $overrides }}
-  {{- if $merged }}
+  {{- with .Values.addons.gpuOperator.valuesOverride }}
   values:
-    {{- toYaml $merged | nindent 4 }}
+    {{- toYaml . | nindent 4 }}
   {{- end }}
 
   dependsOn:
diff --git a/packages/apps/kubernetes/templates/helmreleases/hami.yaml b/packages/apps/kubernetes/templates/helmreleases/hami.yaml
deleted file mode 100644
index f1538c7c..00000000
--- a/packages/apps/kubernetes/templates/helmreleases/hami.yaml
+++ /dev/null
@@ -1,49 +0,0 @@
-{{- if and .Values.addons.hami.enabled .Values._namespace.etcd }}
-{{- if not .Values.addons.gpuOperator.enabled }}
-{{- fail "addons.hami requires addons.gpuOperator to be enabled" }}
-{{- end }}
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: {{ .Release.Name }}-hami
-  labels:
-    cozystack.io/repository: system
-    cozystack.io/target-cluster-name: {{ .Release.Name }}
-    sharding.fluxcd.io/key: tenants
-spec:
-  releaseName: hami
-  chartRef:
-    kind: ExternalArtifact
-    name: cozystack-kubernetes-application-kubevirt-kubernetes-hami
-    namespace: cozy-system
-  kubeConfig:
-    secretRef:
-      name: {{ .Release.Name }}-admin-kubeconfig
-      key: super-admin.svc
-  targetNamespace: cozy-hami
-  storageNamespace: cozy-hami
-  interval: 5m
-  timeout: 10m
-  install:
-    createNamespace: true
-    remediation:
-      retries: -1
-  upgrade:
-    force: true
-    remediation:
-      retries: -1
-  {{- with .Values.addons.hami.valuesOverride }}
-  values:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
-
-  dependsOn:
-  {{- if lookup "helm.toolkit.fluxcd.io/v2" "HelmRelease" .Release.Namespace .Release.Name }}
-  - name: {{ .Release.Name }}
-    namespace: {{ .Release.Namespace }}
-  {{- end }}
-  - name: {{ .Release.Name }}-cilium
-    namespace: {{ .Release.Namespace }}
-  - name: {{ .Release.Name }}-gpu-operator
-    namespace: {{ .Release.Namespace }}
-{{- end }}
diff --git a/packages/apps/kubernetes/templates/helmreleases/ingress-nginx.yaml b/packages/apps/kubernetes/templates/helmreleases/ingress-nginx.yaml
index 6e2183d3..5cafff90 100644
--- a/packages/apps/kubernetes/templates/helmreleases/ingress-nginx.yaml
+++ b/packages/apps/kubernetes/templates/helmreleases/ingress-nginx.yaml
@@ -20,7 +20,7 @@ ingress-nginx:
     node-role.kubernetes.io/ingress-nginx: ""
 {{- end }}
 
-{{- if and .Values.addons.ingressNginx.enabled .Values._namespace.etcd }}
+{{- if .Values.addons.ingressNginx.enabled }}
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:
diff --git a/packages/apps/kubernetes/templates/helmreleases/metrics-server.yaml b/packages/apps/kubernetes/templates/helmreleases/metrics-server.yaml
index 3e6f9660..3cc81a14 100644
--- a/packages/apps/kubernetes/templates/helmreleases/metrics-server.yaml
+++ b/packages/apps/kubernetes/templates/helmreleases/metrics-server.yaml
@@ -1,4 +1,3 @@
-{{- if .Values._namespace.etcd }}
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:
@@ -37,4 +36,3 @@ spec:
     namespace: {{ .Release.Namespace }}
   - name: {{ .Release.Name }}-prometheus-operator-crds
     namespace: {{ .Release.Namespace }}
-{{- end }}
diff --git a/packages/apps/kubernetes/templates/helmreleases/monitoring-agents.yaml b/packages/apps/kubernetes/templates/helmreleases/monitoring-agents.yaml
index a811f7dd..ea84dec0 100644
--- a/packages/apps/kubernetes/templates/helmreleases/monitoring-agents.yaml
+++ b/packages/apps/kubernetes/templates/helmreleases/monitoring-agents.yaml
@@ -1,6 +1,6 @@
 {{- $targetTenant := .Values._namespace.monitoring }}
 {{- $clusterDomain := (index .Values._cluster "cluster-domain") | default "cozy.local" }}
-{{- if and .Values.addons.monitoringAgents.enabled .Values._namespace.etcd }}
+{{- if .Values.addons.monitoringAgents.enabled }}
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:
diff --git a/packages/apps/kubernetes/templates/helmreleases/prometheus-operator-crds.yaml b/packages/apps/kubernetes/templates/helmreleases/prometheus-operator-crds.yaml
index 3038a058..600a7994 100644
--- a/packages/apps/kubernetes/templates/helmreleases/prometheus-operator-crds.yaml
+++ b/packages/apps/kubernetes/templates/helmreleases/prometheus-operator-crds.yaml
@@ -1,4 +1,3 @@
-{{- if .Values._namespace.etcd }}
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:
@@ -32,4 +31,3 @@ spec:
   - name: {{ .Release.Name }}
     namespace: {{ .Release.Namespace }}
   {{- end }}
-{{- end }}
diff --git a/packages/apps/kubernetes/templates/helmreleases/velero.yaml b/packages/apps/kubernetes/templates/helmreleases/velero.yaml
index 781b9c49..ad236d53 100644
--- a/packages/apps/kubernetes/templates/helmreleases/velero.yaml
+++ b/packages/apps/kubernetes/templates/helmreleases/velero.yaml
@@ -1,4 +1,4 @@
-{{- if and .Values.addons.velero.enabled .Values._namespace.etcd }}
+{{- if .Values.addons.velero.enabled }}
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:
diff --git a/packages/apps/kubernetes/templates/helmreleases/vertical-pod-autoscaler-crds.yaml b/packages/apps/kubernetes/templates/helmreleases/vertical-pod-autoscaler-crds.yaml
index 55a5faac..a3b7a9b4 100644
--- a/packages/apps/kubernetes/templates/helmreleases/vertical-pod-autoscaler-crds.yaml
+++ b/packages/apps/kubernetes/templates/helmreleases/vertical-pod-autoscaler-crds.yaml
@@ -1,4 +1,4 @@
-{{- if and .Values.addons.monitoringAgents.enabled .Values._namespace.etcd }}
+{{- if .Values.addons.monitoringAgents.enabled }}
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:
diff --git a/packages/apps/kubernetes/templates/helmreleases/vertical-pod-autoscaler.yaml b/packages/apps/kubernetes/templates/helmreleases/vertical-pod-autoscaler.yaml
index 74fb5a39..178df3e3 100644
--- a/packages/apps/kubernetes/templates/helmreleases/vertical-pod-autoscaler.yaml
+++ b/packages/apps/kubernetes/templates/helmreleases/vertical-pod-autoscaler.yaml
@@ -24,7 +24,7 @@ vertical-pod-autoscaler:
         memory: 1600Mi
 {{- end }}
 
-{{- if and .Values.addons.monitoringAgents.enabled .Values._namespace.etcd }}
+{{- if .Values.addons.monitoringAgents.enabled }}
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:
diff --git a/packages/apps/kubernetes/templates/helmreleases/victoria-metrics-operator.yaml b/packages/apps/kubernetes/templates/helmreleases/victoria-metrics-operator.yaml
index 7302f8f5..99744277 100644
--- a/packages/apps/kubernetes/templates/helmreleases/victoria-metrics-operator.yaml
+++ b/packages/apps/kubernetes/templates/helmreleases/victoria-metrics-operator.yaml
@@ -1,4 +1,4 @@
-{{- if and .Values.addons.monitoringAgents.enabled .Values._namespace.etcd }}
+{{- if .Values.addons.monitoringAgents.enabled }}
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:
diff --git a/packages/apps/kubernetes/templates/helmreleases/volumesnapshot-crd.yaml b/packages/apps/kubernetes/templates/helmreleases/volumesnapshot-crd.yaml
index d50fd93c..025f01b7 100644
--- a/packages/apps/kubernetes/templates/helmreleases/volumesnapshot-crd.yaml
+++ b/packages/apps/kubernetes/templates/helmreleases/volumesnapshot-crd.yaml
@@ -1,4 +1,3 @@
-{{- if .Values._namespace.etcd }}
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:
@@ -34,4 +33,3 @@ spec:
   - name: {{ .Release.Name }}
     namespace: {{ .Release.Namespace }}
   {{- end }}
-{{- end }}
diff --git a/packages/apps/kubernetes/templates/kccm/manager.yaml b/packages/apps/kubernetes/templates/kccm/manager.yaml
index bd9e2798..81426d4e 100644
--- a/packages/apps/kubernetes/templates/kccm/manager.yaml
+++ b/packages/apps/kubernetes/templates/kccm/manager.yaml
@@ -1,4 +1,3 @@
-{{- if .Values._namespace.etcd }}
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -23,8 +22,6 @@ spec:
         - key: node-role.kubernetes.io/control-plane
           operator: Exists
           effect: "NoSchedule"
-      initContainers:
-      {{- include "kubernetes.waitForAdminKubeconfig" $ | nindent 6 }}
       containers:
       - name: kubevirt-cloud-controller-manager
         args:
@@ -58,7 +55,5 @@ spec:
         name: cloud-config
       - secret:
           secretName: {{ .Release.Name }}-admin-kubeconfig
-          optional: true
         name: kubeconfig
       serviceAccountName: {{ .Release.Name }}-kccm
-{{- end }}
diff --git a/packages/apps/kubernetes/tests/admin_kubeconfig_wait_test.yaml b/packages/apps/kubernetes/tests/admin_kubeconfig_wait_test.yaml
deleted file mode 100644
index 507e00af..00000000
--- a/packages/apps/kubernetes/tests/admin_kubeconfig_wait_test.yaml
+++ /dev/null
@@ -1,155 +0,0 @@
-suite: admin-kubeconfig wait guards
-
-release:
-  name: test
-  namespace: tenant-root
-
-values:
-  - values-ci.yaml
-
-tests:
-  - it: cluster-autoscaler mounts admin-kubeconfig as optional
-    template: templates/cluster-autoscaler/deployment.yaml
-    documentSelector:
-      path: kind
-      value: Deployment
-    asserts:
-      - equal:
-          path: spec.template.spec.volumes[?(@.name=="kubeconfig")].secret.secretName
-          value: test-admin-kubeconfig
-      - equal:
-          path: spec.template.spec.volumes[?(@.name=="kubeconfig")].secret.optional
-          value: true
-
-  - it: cluster-autoscaler waits for admin-kubeconfig via initContainer
-    template: templates/cluster-autoscaler/deployment.yaml
-    documentSelector:
-      path: kind
-      value: Deployment
-    asserts:
-      - equal:
-          path: spec.template.spec.initContainers[0].name
-          value: wait-for-kubeconfig
-      - contains:
-          path: spec.template.spec.initContainers[0].volumeMounts
-          content:
-            name: kubeconfig
-            mountPath: /etc/kubernetes/kubeconfig
-            readOnly: true
-
-  - it: kccm mounts admin-kubeconfig as optional
-    template: templates/kccm/manager.yaml
-    documentSelector:
-      path: kind
-      value: Deployment
-    asserts:
-      - equal:
-          path: spec.template.spec.volumes[?(@.name=="kubeconfig")].secret.secretName
-          value: test-admin-kubeconfig
-      - equal:
-          path: spec.template.spec.volumes[?(@.name=="kubeconfig")].secret.optional
-          value: true
-
-  - it: kccm waits for admin-kubeconfig via initContainer
-    template: templates/kccm/manager.yaml
-    documentSelector:
-      path: kind
-      value: Deployment
-    asserts:
-      - equal:
-          path: spec.template.spec.initContainers[0].name
-          value: wait-for-kubeconfig
-      - contains:
-          path: spec.template.spec.initContainers[0].volumeMounts
-          content:
-            name: kubeconfig
-            mountPath: /etc/kubernetes/kubeconfig
-            readOnly: true
-
-  - it: csi controller mounts admin-kubeconfig as optional
-    template: templates/csi/deploy.yaml
-    documentSelector:
-      path: kind
-      value: Deployment
-    asserts:
-      - equal:
-          path: spec.template.spec.volumes[?(@.name=="kubeconfig")].secret.secretName
-          value: test-admin-kubeconfig
-      - equal:
-          path: spec.template.spec.volumes[?(@.name=="kubeconfig")].secret.optional
-          value: true
-
-  - it: csi controller waits for admin-kubeconfig via initContainer
-    template: templates/csi/deploy.yaml
-    documentSelector:
-      path: kind
-      value: Deployment
-    asserts:
-      - equal:
-          path: spec.template.spec.initContainers[0].name
-          value: wait-for-kubeconfig
-      - contains:
-          path: spec.template.spec.initContainers[0].volumeMounts
-          content:
-            name: kubeconfig
-            mountPath: /etc/kubernetes/kubeconfig
-            readOnly: true
-
-  - it: wait-for-kubeconfig defaults to bundled busybox digest pin
-    template: templates/cluster-autoscaler/deployment.yaml
-    documentSelector:
-      path: kind
-      value: Deployment
-    asserts:
-      - matchRegex:
-          path: spec.template.spec.initContainers[0].image
-          pattern: '^docker\.io/library/busybox:[^@]+@sha256:[0-9a-f]{64}$'
-
-  - it: wait-for-kubeconfig honours images.waitForKubeconfig override
-    template: templates/cluster-autoscaler/deployment.yaml
-    documentSelector:
-      path: kind
-      value: Deployment
-    set:
-      images:
-        waitForKubeconfig: "registry.example.test/library/busybox:1.37.0@sha256:0000000000000000000000000000000000000000000000000000000000000000"
-    asserts:
-      - equal:
-          path: spec.template.spec.initContainers[0].image
-          value: "registry.example.test/library/busybox:1.37.0@sha256:0000000000000000000000000000000000000000000000000000000000000000"
-
-  - it: cluster.yaml renders and wires dataStoreName when tenant has etcd
-    template: templates/cluster.yaml
-    documentSelector:
-      path: kind
-      value: KamajiControlPlane
-    asserts:
-      - equal:
-          path: spec.dataStoreName
-          value: tenant-root
-
-  - it: cluster.yaml skips Cluster resources when tenant has no etcd DataStore
-    # Must NOT fail rendering - the parent Tenant chart populates
-    # _namespace.etcd asynchronously, so rendering failures here would cause
-    # flux install remediation on every cold bootstrap. Instead, emit only a
-    # ConfigMap status beacon so the HelmRelease reports Ready while flux
-    # retries on its interval until the DataStore appears.
-    template: templates/cluster.yaml
-    set:
-      _namespace:
-        etcd: ""
-        monitoring: ""
-        ingress: ""
-        seaweedfs: ""
-        host: ""
-    asserts:
-      - hasDocuments:
-          count: 1
-      - isKind:
-          of: ConfigMap
-      - equal:
-          path: metadata.name
-          value: test-awaiting-etcd
-      - equal:
-          path: data.status
-          value: awaiting-etcd
diff --git a/packages/apps/kubernetes/tests/gpu_operator_hami_test.yaml b/packages/apps/kubernetes/tests/gpu_operator_hami_test.yaml
deleted file mode 100644
index 44528470..00000000
--- a/packages/apps/kubernetes/tests/gpu_operator_hami_test.yaml
+++ /dev/null
@@ -1,99 +0,0 @@
-suite: GPU Operator HelmRelease HAMi integration tests
-templates:
-  - templates/helmreleases/gpu-operator.yaml
-values:
-  - values-ci.yaml
-tests:
-  - it: should disable devicePlugin when hami is enabled
-    set:
-      addons:
-        gpuOperator:
-          enabled: true
-          valuesOverride: {}
-        hami:
-          enabled: true
-          valuesOverride: {}
-    asserts:
-      - equal:
-          path: spec.values.gpu-operator.devicePlugin.enabled
-          value: false
-
-  - it: should not have values when hami is disabled and no overrides
-    set:
-      addons:
-        gpuOperator:
-          enabled: true
-          valuesOverride: {}
-        hami:
-          enabled: false
-          valuesOverride: {}
-    asserts:
-      - notExists:
-          path: spec.values
-
-  - it: should apply hami defaults when valuesOverride key is omitted
-    set:
-      addons:
-        gpuOperator:
-          enabled: true
-        hami:
-          enabled: true
-    asserts:
-      - equal:
-          path: spec.values.gpu-operator.devicePlugin.enabled
-          value: false
-
-  - it: should allow user overrides to merge with hami defaults
-    set:
-      addons:
-        gpuOperator:
-          enabled: true
-          valuesOverride:
-            gpu-operator:
-              driver:
-                enabled: false
-        hami:
-          enabled: true
-          valuesOverride: {}
-    asserts:
-      - equal:
-          path: spec.values.gpu-operator.devicePlugin.enabled
-          value: false
-      - equal:
-          path: spec.values.gpu-operator.driver.enabled
-          value: false
-
-  - it: should let user explicitly override devicePlugin.enabled to true with hami enabled
-    set:
-      addons:
-        gpuOperator:
-          enabled: true
-          valuesOverride:
-            gpu-operator:
-              devicePlugin:
-                enabled: true
-              driver:
-                enabled: false
-        hami:
-          enabled: true
-          valuesOverride: {}
-    asserts:
-      - equal:
-          path: spec.values.gpu-operator.devicePlugin.enabled
-          value: true
-      - equal:
-          path: spec.values.gpu-operator.driver.enabled
-          value: false
-
-  - it: should not render when gpuOperator is disabled
-    set:
-      addons:
-        gpuOperator:
-          enabled: false
-          valuesOverride: {}
-        hami:
-          enabled: false
-          valuesOverride: {}
-    asserts:
-      - hasDocuments:
-          count: 0
diff --git a/packages/apps/kubernetes/tests/hami_test.yaml b/packages/apps/kubernetes/tests/hami_test.yaml
deleted file mode 100644
index 27f7c75b..00000000
--- a/packages/apps/kubernetes/tests/hami_test.yaml
+++ /dev/null
@@ -1,153 +0,0 @@
-suite: HAMi HelmRelease tests
-templates:
-  - templates/helmreleases/hami.yaml
-values:
-  - values-ci.yaml
-tests:
-  - it: should not render when hami is disabled
-    set:
-      addons:
-        hami:
-          enabled: false
-          valuesOverride: {}
-        gpuOperator:
-          enabled: true
-          valuesOverride: {}
-    asserts:
-      - hasDocuments:
-          count: 0
-
-  - it: should render HelmRelease when hami is enabled
-    set:
-      addons:
-        hami:
-          enabled: true
-          valuesOverride: {}
-        gpuOperator:
-          enabled: true
-          valuesOverride: {}
-    asserts:
-      - hasDocuments:
-          count: 1
-      - isKind:
-          of: HelmRelease
-
-  - it: should fail when gpuOperator is not enabled
-    set:
-      addons:
-        hami:
-          enabled: true
-          valuesOverride: {}
-        gpuOperator:
-          enabled: false
-          valuesOverride: {}
-    asserts:
-      - failedTemplate:
-          errorMessage: "addons.hami requires addons.gpuOperator to be enabled"
-
-  - it: should have correct metadata labels
-    set:
-      addons:
-        hami:
-          enabled: true
-          valuesOverride: {}
-        gpuOperator:
-          enabled: true
-          valuesOverride: {}
-    asserts:
-      - equal:
-          path: metadata.labels["cozystack.io/repository"]
-          value: system
-      - equal:
-          path: metadata.labels["sharding.fluxcd.io/key"]
-          value: tenants
-
-  - it: should use ExternalArtifact chartRef
-    set:
-      addons:
-        hami:
-          enabled: true
-          valuesOverride: {}
-        gpuOperator:
-          enabled: true
-          valuesOverride: {}
-    asserts:
-      - equal:
-          path: spec.chartRef.kind
-          value: ExternalArtifact
-      - equal:
-          path: spec.chartRef.namespace
-          value: cozy-system
-
-  - it: should target cozy-hami namespace
-    set:
-      addons:
-        hami:
-          enabled: true
-          valuesOverride: {}
-        gpuOperator:
-          enabled: true
-          valuesOverride: {}
-    asserts:
-      - equal:
-          path: spec.targetNamespace
-          value: cozy-hami
-      - equal:
-          path: spec.storageNamespace
-          value: cozy-hami
-
-  - it: should depend on gpu-operator and cilium
-    release:
-      name: test
-      namespace: test-ns
-    set:
-      addons:
-        hami:
-          enabled: true
-          valuesOverride: {}
-        gpuOperator:
-          enabled: true
-          valuesOverride: {}
-    asserts:
-      - contains:
-          path: spec.dependsOn
-          content:
-            name: test-cilium
-            namespace: test-ns
-      - contains:
-          path: spec.dependsOn
-          content:
-            name: test-gpu-operator
-            namespace: test-ns
-
-  - it: should not render spec.values when valuesOverride is empty
-    set:
-      addons:
-        hami:
-          enabled: true
-          valuesOverride: {}
-        gpuOperator:
-          enabled: true
-          valuesOverride: {}
-    asserts:
-      - hasDocuments:
-          count: 1
-      - notExists:
-          path: spec.values
-
-  - it: should pass through valuesOverride
-    set:
-      addons:
-        hami:
-          enabled: true
-          valuesOverride:
-            hami:
-              devicePlugin:
-                deviceSplitCount: 5
-        gpuOperator:
-          enabled: true
-          valuesOverride: {}
-    asserts:
-      - equal:
-          path: spec.values.hami.devicePlugin.deviceSplitCount
-          value: 5
diff --git a/packages/apps/kubernetes/tests/values-ci-no-etcd.yaml b/packages/apps/kubernetes/tests/values-ci-no-etcd.yaml
deleted file mode 100644
index c7c8196f..00000000
--- a/packages/apps/kubernetes/tests/values-ci-no-etcd.yaml
+++ /dev/null
@@ -1,9 +0,0 @@
-_namespace:
-  etcd: ""
-  monitoring: ""
-  ingress: ""
-  seaweedfs: ""
-  host: ""
-_cluster:
-  cluster-domain: cozy.local
-nodeGroups: null
diff --git a/packages/apps/kubernetes/tests/values-ci.yaml b/packages/apps/kubernetes/tests/values-ci.yaml
deleted file mode 100644
index 13365e8c..00000000
--- a/packages/apps/kubernetes/tests/values-ci.yaml
+++ /dev/null
@@ -1,9 +0,0 @@
-_namespace:
-  etcd: tenant-root
-  monitoring: ""
-  ingress: ""
-  seaweedfs: ""
-  host: ""
-_cluster:
-  cluster-domain: cozy.local
-nodeGroups: null
diff --git a/packages/apps/kubernetes/values.schema.json b/packages/apps/kubernetes/values.schema.json
index a43deaec..1beeff9c 100644
--- a/packages/apps/kubernetes/values.schema.json
+++ b/packages/apps/kubernetes/values.schema.json
@@ -149,7 +149,6 @@
         "fluxcd",
         "gatewayAPI",
         "gpuOperator",
-        "hami",
         "ingressNginx",
         "monitoringAgents",
         "velero",
@@ -269,28 +268,6 @@
             }
           }
         },
-        "hami": {
-          "description": "HAMi GPU virtualization middleware.",
-          "type": "object",
-          "default": {},
-          "required": [
-            "enabled",
-            "valuesOverride"
-          ],
-          "properties": {
-            "enabled": {
-              "description": "Enable HAMi (requires GPU Operator).",
-              "type": "boolean",
-              "default": false
-            },
-            "valuesOverride": {
-              "description": "Custom Helm values overrides.",
-              "type": "object",
-              "default": {},
-              "x-kubernetes-preserve-unknown-fields": true
-            }
-          }
-        },
         "ingressNginx": {
           "description": "Ingress-NGINX controller.",
           "type": "object",
@@ -653,18 +630,6 @@
           }
         }
       }
-    },
-    "images": {
-      "description": "Optional image overrides for air-gapped or rate-limited registries.",
-      "type": "object",
-      "default": {},
-      "properties": {
-        "waitForKubeconfig": {
-          "description": "Image used by the wait-for-kubeconfig init container. Empty falls back to images/busybox.tag.",
-          "type": "string",
-          "default": ""
-        }
-      }
     }
   }
 }
diff --git a/packages/apps/kubernetes/values.yaml b/packages/apps/kubernetes/values.yaml
index d609476c..a67b5d69 100644
--- a/packages/apps/kubernetes/values.yaml
+++ b/packages/apps/kubernetes/values.yaml
@@ -94,10 +94,6 @@ host: ""
 ## @field {bool} enabled - Enable FluxCD.
 ## @field {object} valuesOverride - Custom Helm values overrides.
 
-## @typedef {struct} HAMiAddon - HAMi GPU virtualization middleware.
-## @field {bool} enabled - Enable HAMi (requires GPU Operator).
-## @field {object} valuesOverride - Custom Helm values overrides.
-
 ## @typedef {struct} MonitoringAgentsAddon - Monitoring agents (Fluent Bit, VMAgents).
 ## @field {bool} enabled - Enable monitoring agents.
 ## @field {object} valuesOverride - Custom Helm values overrides.
@@ -118,7 +114,6 @@ host: ""
 ## @field {GatewayAPIAddon} gatewayAPI - Gateway API addon.
 ## @field {IngressNginxAddon} ingressNginx - Ingress-NGINX controller.
 ## @field {GPUOperatorAddon} gpuOperator - NVIDIA GPU Operator.
-## @field {HAMiAddon} hami - HAMi GPU virtualization middleware.
 ## @field {FluxCDAddon} fluxcd - FluxCD GitOps operator.
 ## @field {MonitoringAgentsAddon} monitoringAgents - Monitoring agents.
 ## @field {VerticalPodAutoscalerAddon} verticalPodAutoscaler - Vertical Pod Autoscaler.
@@ -142,9 +137,6 @@ addons:
   gpuOperator:
     enabled: false
     valuesOverride: {}
-  hami:
-    enabled: false
-    valuesOverride: {}
   fluxcd:
     enabled: false
     valuesOverride: {}
@@ -205,10 +197,3 @@ controlPlane:
     server:
       resources: {}
       resourcesPreset: "micro"
-
-## @typedef {struct} Images - Optional image overrides for chart-internal helpers.
-## @field {string} [waitForKubeconfig] - Image used by the wait-for-kubeconfig init container. Empty falls back to images/busybox.tag.
-
-## @param {Images} images - Optional image overrides for air-gapped or rate-limited registries.
-images:
-  waitForKubeconfig: ""
diff --git a/packages/apps/postgres/README.md b/packages/apps/postgres/README.md
index 4cda7284..5a550f7a 100644
--- a/packages/apps/postgres/README.md
+++ b/packages/apps/postgres/README.md
@@ -133,13 +133,12 @@ See:
 
 ### Bootstrap (recovery) parameters
 
-| Name                     | Description                                                                                                                                                                                                                  | Type     | Value   |
-| ------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- | ------- |
-| `bootstrap`              | Bootstrap configuration.                                                                                                                                                                                                     | `object` | `{}`    |
-| `bootstrap.enabled`      | Whether to restore from a backup.                                                                                                                                                                                            | `bool`   | `false` |
-| `bootstrap.recoveryTime` | Timestamp (RFC3339) for point-in-time recovery; empty means latest.                                                                                                                                                          | `string` | `""`    |
-| `bootstrap.oldName`      | Previous cluster name before deletion.                                                                                                                                                                                       | `string` | `""`    |
-| `bootstrap.serverName`   | Barman server name (S3 path prefix) used by the original cluster when writing backups. Set this only when the original cluster had an explicit barmanObjectStore.serverName that differed from its Kubernetes resource name. | `string` | `""`    |
+| Name                     | Description                                                         | Type     | Value   |
+| ------------------------ | ------------------------------------------------------------------- | -------- | ------- |
+| `bootstrap`              | Bootstrap configuration.                                            | `object` | `{}`    |
+| `bootstrap.enabled`      | Whether to restore from a backup.                                   | `bool`   | `false` |
+| `bootstrap.recoveryTime` | Timestamp (RFC3339) for point-in-time recovery; empty means latest. | `string` | `""`    |
+| `bootstrap.oldName`      | Previous cluster name before deletion.                              | `string` | `""`    |
 
 
 ## Parameter examples and reference
diff --git a/packages/apps/postgres/templates/db.yaml b/packages/apps/postgres/templates/db.yaml
index 2cdaec1d..5c40b2c7 100644
--- a/packages/apps/postgres/templates/db.yaml
+++ b/packages/apps/postgres/templates/db.yaml
@@ -32,9 +32,6 @@ spec:
     - name: {{ .Values.bootstrap.oldName }}
       barmanObjectStore:
         destinationPath: {{ .Values.backup.destinationPath }}
-        {{- if .Values.bootstrap.serverName }}
-        serverName: {{ .Values.bootstrap.serverName }}
-        {{- end }}
         endpointURL: {{ .Values.backup.endpointURL }}
         s3Credentials:
           accessKeyId:
diff --git a/packages/apps/postgres/values.schema.json b/packages/apps/postgres/values.schema.json
index 98e29822..b2a4aeba 100644
--- a/packages/apps/postgres/values.schema.json
+++ b/packages/apps/postgres/values.schema.json
@@ -254,11 +254,6 @@
           "description": "Timestamp (RFC3339) for point-in-time recovery; empty means latest.",
           "type": "string",
           "default": ""
-        },
-        "serverName": {
-          "description": "Barman server name (S3 path prefix) used by the original cluster when writing backups. Set this only when the original cluster had an explicit barmanObjectStore.serverName that differed from its Kubernetes resource name.",
-          "type": "string",
-          "default": ""
         }
       }
     }
diff --git a/packages/apps/postgres/values.yaml b/packages/apps/postgres/values.yaml
index 2ceaa9cf..b8f07f63 100644
--- a/packages/apps/postgres/values.yaml
+++ b/packages/apps/postgres/values.yaml
@@ -154,7 +154,6 @@ backup:
 ## @field {bool} enabled - Whether to restore from a backup.
 ## @field {string} [recoveryTime] - Timestamp (RFC3339) for point-in-time recovery; empty means latest.
 ## @field {string} oldName - Previous cluster name before deletion.
-## @field {string} [serverName] - Barman server name (S3 path prefix) used by the original cluster when writing backups. Set this only when the original cluster had an explicit barmanObjectStore.serverName that differed from its Kubernetes resource name.
 
 ## @param {Bootstrap} bootstrap - Bootstrap configuration.
 bootstrap:
@@ -162,4 +161,3 @@ bootstrap:
   # example: 2020-11-26 15:22:00.00000+00
   recoveryTime: ""
   oldName: ""
-  serverName: ""
diff --git a/packages/apps/tenant/Makefile b/packages/apps/tenant/Makefile
index 2f51d836..3fe3810d 100644
--- a/packages/apps/tenant/Makefile
+++ b/packages/apps/tenant/Makefile
@@ -3,6 +3,3 @@ include ../../../hack/package.mk
 generate:
 	cozyvalues-gen -m 'tenant' -v values.yaml -s values.schema.json -r README.md -g ../../../api/apps/v1alpha1/tenant/types.go
 	../../../hack/update-crd.sh
-
-test:
-	helm unittest .
diff --git a/packages/apps/tenant/templates/cilium-lb-pool.yaml b/packages/apps/tenant/templates/cilium-lb-pool.yaml
deleted file mode 100644
index 63dbcaca..00000000
--- a/packages/apps/tenant/templates/cilium-lb-pool.yaml
+++ /dev/null
@@ -1,28 +0,0 @@
-{{- $exposeMode := (index .Values._cluster "expose-mode") | default "externalIPs" }}
-{{- $exposeIngress := (index .Values._cluster "expose-ingress") | default "tenant-root" }}
-{{- $exposeIPs := (index .Values._cluster "expose-external-ips") | default "" | nospace }}
-{{- $ipsList := list }}
-{{- range splitList "," $exposeIPs }}
-  {{- $ip := . | trim }}
-  {{- if $ip }}
-    {{- $ipsList = append $ipsList $ip }}
-  {{- end }}
-{{- end }}
-{{- $isPublishingIngressLB := and
-      (eq $exposeMode "loadBalancer")
-      (eq $exposeIngress .Release.Namespace)
-      .Values.ingress }}
-{{- if and $isPublishingIngressLB $ipsList }}
-apiVersion: cilium.io/v2
-kind: CiliumLoadBalancerIPPool
-metadata:
-  name: {{ trimPrefix "tenant-" .Release.Namespace }}-exposure
-spec:
-  blocks:
-  {{- range $ipsList }}
-  - cidr: {{ . }}{{ if not (contains "/" .) }}/{{ if contains ":" . }}128{{ else }}32{{ end }}{{ end }}
-  {{- end }}
-  serviceSelector:
-    matchLabels:
-      "io.kubernetes.service.namespace": {{ .Release.Namespace | quote }}
-{{- end }}
diff --git a/packages/apps/tenant/tests/exposure_test.yaml b/packages/apps/tenant/tests/exposure_test.yaml
deleted file mode 100644
index e86fab5b..00000000
--- a/packages/apps/tenant/tests/exposure_test.yaml
+++ /dev/null
@@ -1,141 +0,0 @@
-suite: tenant CiliumLoadBalancerIPPool rendering for publishing.exposure=loadBalancer
-templates:
-  - templates/cilium-lb-pool.yaml
-
-release:
-  name: tenant-root
-  namespace: tenant-root
-
-tests:
-  - it: default exposure (externalIPs) renders no pool
-    set:
-      ingress: true
-      _cluster:
-        expose-ingress: tenant-root
-        expose-external-ips: "192.0.2.10,192.0.2.11"
-    asserts:
-      - hasDocuments:
-          count: 0
-
-  - it: loadBalancer mode in publishing tenant with ingress=true renders v2 pool with namespace-only selector
-    set:
-      ingress: true
-      _cluster:
-        expose-ingress: tenant-root
-        expose-external-ips: "192.0.2.10,192.0.2.11"
-        expose-mode: loadBalancer
-    asserts:
-      - hasDocuments:
-          count: 1
-      - equal:
-          path: apiVersion
-          value: cilium.io/v2
-      - equal:
-          path: kind
-          value: CiliumLoadBalancerIPPool
-      - equal:
-          path: metadata.name
-          value: root-exposure
-      - equal:
-          path: spec.blocks
-          value:
-            - cidr: 192.0.2.10/32
-            - cidr: 192.0.2.11/32
-      - equal:
-          path: spec.serviceSelector.matchLabels["io.kubernetes.service.namespace"]
-          value: tenant-root
-      - notExists:
-          path: spec.serviceSelector.matchLabels["app.kubernetes.io/name"]
-
-  - it: loadBalancer mode with IPv6 emits /128 CIDR
-    set:
-      ingress: true
-      _cluster:
-        expose-ingress: tenant-root
-        expose-external-ips: "2001:db8::1"
-        expose-mode: loadBalancer
-    asserts:
-      - equal:
-          path: spec.blocks
-          value:
-            - cidr: 2001:db8::1/128
-
-  - it: loadBalancer mode with mixed IPv4 and IPv6 emits correct CIDR per family
-    set:
-      ingress: true
-      _cluster:
-        expose-ingress: tenant-root
-        expose-external-ips: "192.0.2.10,2001:db8::1"
-        expose-mode: loadBalancer
-    asserts:
-      - equal:
-          path: spec.blocks
-          value:
-            - cidr: 192.0.2.10/32
-            - cidr: 2001:db8::1/128
-
-  - it: loadBalancer mode accepts pre-CIDR input without double-suffixing
-    set:
-      ingress: true
-      _cluster:
-        expose-ingress: tenant-root
-        expose-external-ips: "192.0.2.10/32,2001:db8::1/128"
-        expose-mode: loadBalancer
-    asserts:
-      - equal:
-          path: spec.blocks
-          value:
-            - cidr: 192.0.2.10/32
-            - cidr: 2001:db8::1/128
-
-  - it: loadBalancer mode filters out empty entries from externalIPs (trailing, leading, repeated commas)
-    set:
-      ingress: true
-      _cluster:
-        expose-ingress: tenant-root
-        expose-external-ips: "192.0.2.10,,192.0.2.11,"
-        expose-mode: loadBalancer
-    asserts:
-      - hasDocuments:
-          count: 1
-      - equal:
-          path: spec.blocks
-          value:
-            - cidr: 192.0.2.10/32
-            - cidr: 192.0.2.11/32
-
-  - it: loadBalancer mode with ingress=false in publishing tenant renders no pool
-    set:
-      ingress: false
-      _cluster:
-        expose-ingress: tenant-root
-        expose-external-ips: "192.0.2.10"
-        expose-mode: loadBalancer
-    asserts:
-      - hasDocuments:
-          count: 0
-
-  - it: loadBalancer mode in a non-publishing tenant renders no pool
-    set:
-      ingress: true
-      _cluster:
-        expose-ingress: tenant-root
-        expose-external-ips: "192.0.2.10"
-        expose-mode: loadBalancer
-    release:
-      name: tenant-u1
-      namespace: tenant-u1
-    asserts:
-      - hasDocuments:
-          count: 0
-
-  - it: loadBalancer mode in publishing tenant with empty externalIPs renders no pool
-    set:
-      ingress: true
-      _cluster:
-        expose-ingress: tenant-root
-        expose-external-ips: ""
-        expose-mode: loadBalancer
-    asserts:
-      - hasDocuments:
-          count: 0
diff --git a/packages/apps/vm-instance/README.md b/packages/apps/vm-instance/README.md
index 9d6a52b2..a2b6603e 100644
--- a/packages/apps/vm-instance/README.md
+++ b/packages/apps/vm-instance/README.md
@@ -36,32 +36,31 @@ virtctl ssh <user>@<vm>
 
 ### Common parameters
 
-| Name                | Description                                                                                                                                                                                                   | Type       | Value       |
-| ------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------- | ----------- |
-| `external`          | Enable external access from outside the cluster.                                                                                                                                                              | `bool`     | `false`     |
-| `externalMethod`    | Method to pass through traffic to the VM.                                                                                                                                                                     | `string`   | `PortList`  |
-| `externalPorts`     | Ports to forward from outside the cluster.                                                                                                                                                                    | `[]int`    | `[22]`      |
-| `externalAllowICMP` | Whether to accept ICMP traffic to the VM in PortList mode (preserves ping and PMTU discovery). No effect in WholeIP mode. Default true so ping behaves as users expect even when port filtering is in effect. | `bool`     | `true`      |
-| `runStrategy`       | Requested running state of the VirtualMachineInstance                                                                                                                                                         | `string`   | `Always`    |
-| `instanceType`      | Virtual Machine instance type.                                                                                                                                                                                | `string`   | `u1.medium` |
-| `instanceProfile`   | Virtual Machine preferences profile.                                                                                                                                                                          | `string`   | `ubuntu`    |
-| `disks`             | List of disks to attach.                                                                                                                                                                                      | `[]object` | `[]`        |
-| `disks[i].name`     | Disk name.                                                                                                                                                                                                    | `string`   | `""`        |
-| `disks[i].bus`      | Disk bus type (e.g. "sata").                                                                                                                                                                                  | `string`   | `""`        |
-| `networks`          | Networks to attach the VM to.                                                                                                                                                                                 | `[]object` | `[]`        |
-| `networks[i].name`  | Network attachment name.                                                                                                                                                                                      | `string`   | `""`        |
-| `subnets`           | Deprecated: use networks instead.                                                                                                                                                                             | `[]object` | `[]`        |
-| `subnets[i].name`   | Network attachment name.                                                                                                                                                                                      | `string`   | `""`        |
-| `gpus`              | List of GPUs to attach (NVIDIA driver requires at least 4 GiB RAM).                                                                                                                                           | `[]object` | `[]`        |
-| `gpus[i].name`      | The name of the GPU resource to attach.                                                                                                                                                                       | `string`   | `""`        |
-| `cpuModel`          | Model specifies the CPU model inside the VMI. List of available models https://github.com/libvirt/libvirt/tree/master/src/cpu_map                                                                             | `string`   | `""`        |
-| `resources`         | Resource configuration for the virtual machine.                                                                                                                                                               | `object`   | `{}`        |
-| `resources.cpu`     | Number of CPU cores allocated.                                                                                                                                                                                | `quantity` | `""`        |
-| `resources.memory`  | Amount of memory allocated.                                                                                                                                                                                   | `quantity` | `""`        |
-| `resources.sockets` | Number of CPU sockets (vCPU topology).                                                                                                                                                                        | `quantity` | `""`        |
-| `sshKeys`           | List of SSH public keys for authentication.                                                                                                                                                                   | `[]string` | `[]`        |
-| `cloudInit`         | Cloud-init user data.                                                                                                                                                                                         | `string`   | `""`        |
-| `cloudInitSeed`     | Seed string to generate SMBIOS UUID for the VM.                                                                                                                                                               | `string`   | `""`        |
+| Name                | Description                                                                                                                       | Type       | Value       |
+| ------------------- | --------------------------------------------------------------------------------------------------------------------------------- | ---------- | ----------- |
+| `external`          | Enable external access from outside the cluster.                                                                                  | `bool`     | `false`     |
+| `externalMethod`    | Method to pass through traffic to the VM.                                                                                         | `string`   | `PortList`  |
+| `externalPorts`     | Ports to forward from outside the cluster.                                                                                        | `[]int`    | `[22]`      |
+| `runStrategy`       | Requested running state of the VirtualMachineInstance                                                                             | `string`   | `Always`    |
+| `instanceType`      | Virtual Machine instance type.                                                                                                    | `string`   | `u1.medium` |
+| `instanceProfile`   | Virtual Machine preferences profile.                                                                                              | `string`   | `ubuntu`    |
+| `disks`             | List of disks to attach.                                                                                                          | `[]object` | `[]`        |
+| `disks[i].name`     | Disk name.                                                                                                                        | `string`   | `""`        |
+| `disks[i].bus`      | Disk bus type (e.g. "sata").                                                                                                      | `string`   | `""`        |
+| `networks`          | Networks to attach the VM to.                                                                                                     | `[]object` | `[]`        |
+| `networks[i].name`  | Network attachment name.                                                                                                          | `string`   | `""`        |
+| `subnets`           | Deprecated: use networks instead.                                                                                                 | `[]object` | `[]`        |
+| `subnets[i].name`   | Network attachment name.                                                                                                          | `string`   | `""`        |
+| `gpus`              | List of GPUs to attach (NVIDIA driver requires at least 4 GiB RAM).                                                               | `[]object` | `[]`        |
+| `gpus[i].name`      | The name of the GPU resource to attach.                                                                                           | `string`   | `""`        |
+| `cpuModel`          | Model specifies the CPU model inside the VMI. List of available models https://github.com/libvirt/libvirt/tree/master/src/cpu_map | `string`   | `""`        |
+| `resources`         | Resource configuration for the virtual machine.                                                                                   | `object`   | `{}`        |
+| `resources.cpu`     | Number of CPU cores allocated.                                                                                                    | `quantity` | `""`        |
+| `resources.memory`  | Amount of memory allocated.                                                                                                       | `quantity` | `""`        |
+| `resources.sockets` | Number of CPU sockets (vCPU topology).                                                                                            | `quantity` | `""`        |
+| `sshKeys`           | List of SSH public keys for authentication.                                                                                       | `[]string` | `[]`        |
+| `cloudInit`         | Cloud-init user data.                                                                                                             | `string`   | `""`        |
+| `cloudInitSeed`     | Seed string to generate SMBIOS UUID for the VM.                                                                                   | `string`   | `""`        |
 
 
 ## U Series
diff --git a/packages/apps/vm-instance/templates/service.yaml b/packages/apps/vm-instance/templates/service.yaml
index cfeffa81..b7e3a420 100644
--- a/packages/apps/vm-instance/templates/service.yaml
+++ b/packages/apps/vm-instance/templates/service.yaml
@@ -9,10 +9,7 @@ metadata:
 {{- if .Values.external }}
     service.kubernetes.io/service-proxy-name: "cozy-proxy"
   annotations:
-    networking.cozystack.io/wholeIP: {{ ternary "true" "false" (eq .Values.externalMethod "WholeIP") | quote }}
-    {{- if eq .Values.externalMethod "PortList" }}
-    networking.cozystack.io/allowICMP: {{ ternary "true" "false" (ne .Values.externalAllowICMP false) | quote }}
-    {{- end }}
+    networking.cozystack.io/wholeIP: "true"
 {{- end }}
 spec:
   type: {{ ternary "LoadBalancer" "ClusterIP" .Values.external }}
diff --git a/packages/apps/vm-instance/values.schema.json b/packages/apps/vm-instance/values.schema.json
index 01bd30a9..34f7f634 100644
--- a/packages/apps/vm-instance/values.schema.json
+++ b/packages/apps/vm-instance/values.schema.json
@@ -26,11 +26,6 @@
         "type": "integer"
       }
     },
-    "externalAllowICMP": {
-      "description": "Whether to accept ICMP traffic to the VM in PortList mode (preserves ping and PMTU discovery). No effect in WholeIP mode. Default true so ping behaves as users expect even when port filtering is in effect.",
-      "type": "boolean",
-      "default": true
-    },
     "runStrategy": {
       "description": "Requested running state of the VirtualMachineInstance",
       "type": "string",
diff --git a/packages/apps/vm-instance/values.yaml b/packages/apps/vm-instance/values.yaml
index 92e399c2..f07b75d3 100644
--- a/packages/apps/vm-instance/values.yaml
+++ b/packages/apps/vm-instance/values.yaml
@@ -31,9 +31,6 @@ externalMethod: PortList
 externalPorts:
 - 22
 
-## @param {bool} externalAllowICMP - Whether to accept ICMP traffic to the VM in PortList mode (preserves ping and PMTU discovery). No effect in WholeIP mode. Default true so ping behaves as users expect even when port filtering is in effect.
-externalAllowICMP: true
-
 ## @enum {string} RunStrategy - Requested running state of the VirtualMachineInstance
 ## @value Always - VMI should always be running
 ## @value Halted - VMI should never be running
diff --git a/packages/core/installer/images/cozystack-operator/Dockerfile b/packages/core/installer/images/cozystack-operator/Dockerfile
index 4268b2ba..01722636 100644
--- a/packages/core/installer/images/cozystack-operator/Dockerfile
+++ b/packages/core/installer/images/cozystack-operator/Dockerfile
@@ -1,4 +1,4 @@
-FROM golang:1.25-alpine as builder
+FROM golang:1.26-alpine AS builder
 
 ARG TARGETOS
 ARG TARGETARCH
diff --git a/packages/core/platform/sources/hami.yaml b/packages/core/platform/sources/hami.yaml
deleted file mode 100644
index 0184e405..00000000
--- a/packages/core/platform/sources/hami.yaml
+++ /dev/null
@@ -1,24 +0,0 @@
----
-apiVersion: cozystack.io/v1alpha1
-kind: PackageSource
-metadata:
-  name: cozystack.hami
-spec:
-  sourceRef:
-    kind: OCIRepository
-    name: cozystack-packages
-    namespace: cozy-system
-    path: /
-  variants:
-  - name: default
-    dependsOn:
-    - cozystack.gpu-operator
-    components:
-    - name: hami
-      path: system/hami
-      valuesFiles:
-      - values.yaml
-      install:
-        privileged: true
-        namespace: cozy-hami
-        releaseName: hami
diff --git a/packages/core/platform/sources/kubernetes-application.yaml b/packages/core/platform/sources/kubernetes-application.yaml
index 088383ad..9787cb19 100644
--- a/packages/core/platform/sources/kubernetes-application.yaml
+++ b/packages/core/platform/sources/kubernetes-application.yaml
@@ -52,8 +52,6 @@ spec:
           path: system/cilium
         - name: kubernetes-gpu-operator
           path: system/gpu-operator
-        - name: kubernetes-hami
-          path: system/hami
         - name: kubernetes-vertical-pod-autoscaler
           path: system/vertical-pod-autoscaler
         - name: kubernetes-prometheus-operator-crds
diff --git a/packages/core/platform/templates/apps.yaml b/packages/core/platform/templates/apps.yaml
index 6e1ae25a..7ee0de52 100644
--- a/packages/core/platform/templates/apps.yaml
+++ b/packages/core/platform/templates/apps.yaml
@@ -30,7 +30,6 @@ stringData:
       expose-services: {{ .Values.publishing.exposedServices | join "," | quote }}
       expose-ingress: {{ .Values.publishing.ingressName | quote }}
       expose-external-ips: {{ .Values.publishing.externalIPs | join "," | quote }}
-      expose-mode: {{ .Values.publishing.exposure | default "externalIPs" | quote }}
       cluster-domain: {{ .Values.networking.clusterDomain | quote }}
       api-server-endpoint: {{ .Values.publishing.apiServerEndpoint | quote }}
       {{- with .Values.branding }}
diff --git a/packages/core/platform/templates/bundles/iaas.yaml b/packages/core/platform/templates/bundles/iaas.yaml
index 66ec98b2..ced0a322 100644
--- a/packages/core/platform/templates/bundles/iaas.yaml
+++ b/packages/core/platform/templates/bundles/iaas.yaml
@@ -10,7 +10,6 @@
 {{include "cozystack.platform.package.default" (list "cozystack.kubevirt-cdi" $) }}
 {{include "cozystack.platform.package.optional.default" (list "cozystack.vm-default-images" $) }}
 {{include "cozystack.platform.package.optional.default" (list "cozystack.gpu-operator" $) }}
-{{include "cozystack.platform.package.optional.default" (list "cozystack.hami" $) }}
 {{include "cozystack.platform.package.default" (list "cozystack.kamaji" $) }}
 {{include "cozystack.platform.package.default" (list "cozystack.capi-operator" $) }}
 {{include "cozystack.platform.package.default" (list "cozystack.capi-provider-bootstrap-kubeadm" $) }}
diff --git a/packages/core/platform/templates/bundles/system.yaml b/packages/core/platform/templates/bundles/system.yaml
index 6c587c82..43ea7266 100644
--- a/packages/core/platform/templates/bundles/system.yaml
+++ b/packages/core/platform/templates/bundles/system.yaml
@@ -105,6 +105,9 @@
 {{- /* cozystack-api DaemonSet */ -}}
 {{- $apiValues := dict "cozystackAPI" (dict "nodeSelector" $genericNodeSelector) -}}
 {{- $_ := set $cozystackEngineComponents "cozystack-api" (dict "values" $apiValues) -}}
+{{- /* lineage-controller-webhook DaemonSet */ -}}
+{{- $lineageValues := dict "lineageControllerWebhook" (dict "nodeSelector" $genericNodeSelector) -}}
+{{- $_ := set $cozystackEngineComponents "lineage-controller-webhook" (dict "values" $lineageValues) -}}
 {{- end -}}
 {{- if .Values.authentication.oidc.enabled }}
 {{include "cozystack.platform.package" (list "cozystack.cozystack-engine" "oidc" $ $cozystackEngineComponents) }}
diff --git a/packages/core/platform/values.yaml b/packages/core/platform/values.yaml
index 605e23bc..f33926db 100644
--- a/packages/core/platform/values.yaml
+++ b/packages/core/platform/values.yaml
@@ -45,41 +45,6 @@ publishing:
     - cdi-uploadproxy
   apiServerEndpoint: "" # example: "https://api.example.org"
   externalIPs: []
-  # Exposure mode for the ingress-nginx Service. When "externalIPs" (current
-  # default) is selected, the Service is created as ClusterIP with
-  # Service.spec.externalIPs set from publishing.externalIPs. When
-  # "loadBalancer" is selected, the Service is type: LoadBalancer and a
-  # CiliumLoadBalancerIPPool makes those same addresses allocatable via LB IPAM.
-  #
-  # Service.spec.externalIPs is deprecated upstream in Kubernetes v1.36
-  # (KEP-5707). The AllowServiceExternalIPs feature gate is expected to default
-  # to false around v1.40 and the implementation removed around v1.43 — switch
-  # to "loadBalancer" before upgrading past v1.40.
-  #
-  # Caveats for the "loadBalancer" mode:
-  #   - publishing.externalIPs must contain at least one non-empty address,
-  #     otherwise the chart render fails with an explicit error (a LoadBalancer
-  #     Service without a pool would sit in <pending> forever).
-  #   - The ingress-nginx Service is created with externalTrafficPolicy: Local
-  #     to preserve the client source IP. Traffic arriving on a node that does
-  #     not host an ingress-nginx pod is dropped, so the external IP must be
-  #     routed to a node that runs the ingress pod (floating IP / keepalived /
-  #     upstream router / podAntiAffinity).
-  #   - Cilium does NOT announce the IP on its own unless L2 announcements or
-  #     BGP are enabled in the Cilium values (disabled by default in Cozystack).
-  #     This mode assumes the operator already routes the externalIPs to a
-  #     cluster node; enabling announcements is out of scope for this setting.
-  #   - Switching this value on a running cluster causes the ingress-nginx
-  #     Service to be recreated (the HelmRelease has upgrade.force: true and
-  #     the Service kind changes between ClusterIP and LoadBalancer). Expect a
-  #     brief interruption of ingress traffic during the flip.
-  #
-  # Scope: this setting only controls the ingress-nginx Service. Other
-  # cozystack components that currently write Service.spec.externalIPs directly
-  # (e.g. the vpn app at packages/apps/vpn/templates/service.yaml) are NOT
-  # migrated by flipping this value and must be addressed separately before
-  # the AllowServiceExternalIPs feature gate flips to off in ~v1.40.
-  exposure: externalIPs # "externalIPs" or "loadBalancer"
   certificates:
     solver: http01 # "http01" or "dns01"
     issuerName: letsencrypt-prod
diff --git a/packages/extra/etcd/Makefile b/packages/extra/etcd/Makefile
index 2b3ed61e..f37d6e1e 100644
--- a/packages/extra/etcd/Makefile
+++ b/packages/extra/etcd/Makefile
@@ -5,6 +5,3 @@ include ../../../hack/package.mk
 generate:
 	cozyvalues-gen -v values.yaml -s values.schema.json -r README.md
 	../../../hack/update-crd.sh
-
-test:
-	helm unittest .
diff --git a/packages/extra/etcd/templates/hook/job.yaml b/packages/extra/etcd/templates/hook/job.yaml
new file mode 100644
index 00000000..3bf2f84b
--- /dev/null
+++ b/packages/extra/etcd/templates/hook/job.yaml
@@ -0,0 +1,39 @@
+{{- $shouldUpdateCerts := true }}
+{{- $configMap := lookup "v1" "ConfigMap" .Release.Namespace "etcd-deployed-version" }}
+{{- if $configMap }}
+  {{- $deployedVersion := index $configMap "data" "version" }}
+  {{- if $deployedVersion | semverCompare ">= 2.6.1" }}
+    {{- $shouldUpdateCerts = false }}
+  {{- end }}
+{{- end }}
+
+{{- if $shouldUpdateCerts }}
+---
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: etcd-hook
+  annotations:
+    helm.sh/hook: post-upgrade
+    helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
+spec:
+  template:
+    metadata:
+      labels:
+        policy.cozystack.io/allow-to-apiserver: "true"
+    spec:
+      serviceAccountName: etcd-hook
+      containers:
+        - name: kubectl
+          image: docker.io/alpine/k8s:1.33.4
+          command:
+          - sh
+          args:
+            - -exc
+            - |-
+              kubectl --namespace={{ .Release.Namespace }} delete secrets etcd-ca-tls etcd-peer-ca-tls 
+              sleep 10
+              kubectl --namespace={{ .Release.Namespace }} delete secrets etcd-client-tls etcd-peer-tls etcd-server-tls
+              kubectl --namespace={{ .Release.Namespace }} delete pods --selector=app.kubernetes.io/instance=etcd,app.kubernetes.io/managed-by=etcd-operator,app.kubernetes.io/name=etcd,cozystack.io/service=etcd
+      restartPolicy: Never
+{{- end }}
diff --git a/packages/extra/etcd/templates/hook/role.yaml b/packages/extra/etcd/templates/hook/role.yaml
new file mode 100644
index 00000000..327eeadb
--- /dev/null
+++ b/packages/extra/etcd/templates/hook/role.yaml
@@ -0,0 +1,26 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  annotations:
+    helm.sh/hook: post-upgrade
+    helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
+  name: etcd-hook
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - secrets
+  - pods
+  verbs:
+  - get
+  - list
+  - watch
+  - delete
+- apiGroups:
+  - ""
+  resources:
+  - configmaps
+  verbs:
+  - get
+  - list
+  - watch
diff --git a/packages/extra/etcd/templates/hook/rolebinding.yaml b/packages/extra/etcd/templates/hook/rolebinding.yaml
new file mode 100644
index 00000000..0ee0ffd1
--- /dev/null
+++ b/packages/extra/etcd/templates/hook/rolebinding.yaml
@@ -0,0 +1,15 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: etcd-hook
+  annotations:
+    helm.sh/hook: post-upgrade
+    helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: etcd-hook
+subjects:
+  - kind: ServiceAccount
+    name: etcd-hook
+    namespace: {{ .Release.Namespace | quote }}
diff --git a/packages/extra/etcd/templates/hook/serviceaccount.yaml b/packages/extra/etcd/templates/hook/serviceaccount.yaml
new file mode 100644
index 00000000..552fb5fc
--- /dev/null
+++ b/packages/extra/etcd/templates/hook/serviceaccount.yaml
@@ -0,0 +1,7 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: etcd-hook
+  annotations:
+    helm.sh/hook: post-upgrade
+    helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
diff --git a/packages/extra/etcd/templates/version.yaml b/packages/extra/etcd/templates/version.yaml
new file mode 100644
index 00000000..cc9375bb
--- /dev/null
+++ b/packages/extra/etcd/templates/version.yaml
@@ -0,0 +1,6 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: etcd-deployed-version
+data:
+  version: {{ .Chart.Version }}
diff --git a/packages/extra/etcd/tests/no-post-upgrade-hook_test.yaml b/packages/extra/etcd/tests/no-post-upgrade-hook_test.yaml
deleted file mode 100644
index 0e4f5aa3..00000000
--- a/packages/extra/etcd/tests/no-post-upgrade-hook_test.yaml
+++ /dev/null
@@ -1,34 +0,0 @@
-suite: etcd chart does not ship a destructive post-upgrade cert-regeneration hook
-
-release:
-  name: etcd
-  namespace: tenant-root
-
-templates:
-  - templates/check-release-name.yaml
-  - templates/dashboard-resourcemap.yaml
-  - templates/datastore.yaml
-  - templates/etcd-defrag.yaml
-  - templates/hook/job.yaml
-  - templates/podscrape.yaml
-  - templates/prometheus-rules.yaml
-  - templates/version.yaml
-
-tests:
-  - it: renders no Job named etcd-hook
-    documentSelector:
-      path: metadata.name
-      value: etcd-hook
-      skipEmptyTemplates: true
-    asserts:
-      - hasDocuments:
-          count: 0
-
-  - it: renders no ConfigMap named etcd-deployed-version
-    documentSelector:
-      path: metadata.name
-      value: etcd-deployed-version
-      skipEmptyTemplates: true
-    asserts:
-      - hasDocuments:
-          count: 0
diff --git a/packages/extra/ingress/Makefile b/packages/extra/ingress/Makefile
index 65b53c03..958ce484 100644
--- a/packages/extra/ingress/Makefile
+++ b/packages/extra/ingress/Makefile
@@ -10,6 +10,3 @@ get-cloudflare-ips:
 generate:
 	cozyvalues-gen -v values.yaml -s values.schema.json -r README.md
 	../../../hack/update-crd.sh
-
-test:
-	helm unittest .
diff --git a/packages/extra/ingress/README.md b/packages/extra/ingress/README.md
index c541d8e9..0e786dfb 100644
--- a/packages/extra/ingress/README.md
+++ b/packages/extra/ingress/README.md
@@ -14,17 +14,3 @@
 | `resources.memory` | Memory (RAM) available to each replica.                                                                                                 | `quantity` | `""`    |
 | `resourcesPreset`  | Default sizing preset used when `resources` is omitted.                                                                                 | `string`   | `micro` |
 
-
-## Exposure mode
-
-The ingress Service type is driven by the cluster-wide `publishing.exposure` value in the platform chart, not by any key in this package. Two modes exist:
-
-- `externalIPs` (default) has three rendered shapes:
-  - Release namespace matches `publishing.ingressName` AND `publishing.externalIPs` is non-empty → Service is `ClusterIP` with `Service.spec.externalIPs` set from that list and `externalTrafficPolicy: Cluster`.
-  - Release namespace matches `publishing.ingressName` but `publishing.externalIPs` is empty → Service falls back to `type: LoadBalancer` with `externalTrafficPolicy: Local`.
-  - Release namespace does not match `publishing.ingressName` (non-root tenants) → Service is `type: LoadBalancer` with `externalTrafficPolicy: Local`.
-  `Service.spec.externalIPs` is deprecated upstream in Kubernetes v1.36 (KEP-5707); plan migration before v1.40.
-- `loadBalancer` — Service is `type: LoadBalancer` with `externalTrafficPolicy: Local`, and a `CiliumLoadBalancerIPPool` makes the addresses in `publishing.externalIPs` allocatable via Cilium LB IPAM. Requires `publishing.externalIPs` to contain at least one non-empty address (render fails otherwise) and assumes the addresses are already routed to a cluster node (floating IP / upstream router). See the inline comment on `publishing.exposure` in the platform chart for full caveats, including the note that switching the value on a running cluster causes the ingress Service to be recreated.
-
-This setting only migrates ingress-nginx away from `Service.spec.externalIPs`. Other cozystack components that use the same deprecated field (e.g. the `vpn` app) must be migrated separately before Kubernetes v1.40 flips the `AllowServiceExternalIPs` feature gate off.
-
diff --git a/packages/extra/ingress/templates/nginx-ingress.yaml b/packages/extra/ingress/templates/nginx-ingress.yaml
index 8e1f00fb..ca50d276 100644
--- a/packages/extra/ingress/templates/nginx-ingress.yaml
+++ b/packages/extra/ingress/templates/nginx-ingress.yaml
@@ -1,19 +1,5 @@
 {{- $exposeIngress := (index .Values._cluster "expose-ingress") | default "tenant-root" }}
 {{- $exposeExternalIPs := (index .Values._cluster "expose-external-ips") | default "" | nospace }}
-{{- $exposeMode := (index .Values._cluster "expose-mode") | default "externalIPs" }}
-{{- $exposeIPsList := list }}
-{{- range splitList "," $exposeExternalIPs }}
-  {{- $ip := . | trim }}
-  {{- if $ip }}
-    {{- $exposeIPsList = append $exposeIPsList $ip }}
-  {{- end }}
-{{- end }}
-{{- if not (has $exposeMode (list "externalIPs" "loadBalancer")) }}
-{{- fail (printf "unknown publishing.exposure mode %q: must be \"externalIPs\" or \"loadBalancer\"" $exposeMode) }}
-{{- end }}
-{{- if and (eq $exposeMode "loadBalancer") (eq $exposeIngress .Release.Namespace) (not $exposeIPsList) }}
-{{- fail "publishing.exposure=loadBalancer requires publishing.externalIPs to contain at least one non-empty address: the CiliumLoadBalancerIPPool has nothing to advertise and the Service would stay in <pending>." }}
-{{- end }}
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:
@@ -55,12 +41,9 @@ spec:
           enabled: false
         {{- end }}
         service:
-          {{- if and (eq $exposeIngress .Release.Namespace) (eq $exposeMode "loadBalancer") }}
-          type: LoadBalancer
-          externalTrafficPolicy: Local
-          {{- else if and (eq $exposeIngress .Release.Namespace) $exposeIPsList }}
+          {{- if and (eq $exposeIngress .Release.Namespace) $exposeExternalIPs }}
           externalIPs:
-            {{- toYaml $exposeIPsList | nindent 12 }}
+            {{- toYaml (splitList "," $exposeExternalIPs) | nindent 12 }}
           type: ClusterIP
           externalTrafficPolicy: Cluster
           {{- else }}
diff --git a/packages/extra/ingress/tests/exposure_test.yaml b/packages/extra/ingress/tests/exposure_test.yaml
deleted file mode 100644
index 1c76b3da..00000000
--- a/packages/extra/ingress/tests/exposure_test.yaml
+++ /dev/null
@@ -1,165 +0,0 @@
-suite: ingress exposure modes
-templates:
-  - templates/nginx-ingress.yaml
-
-release:
-  name: ingress
-  namespace: tenant-root
-
-tests:
-  - it: default exposure (externalIPs) renders ClusterIP Service with spec.externalIPs
-    set:
-      _cluster:
-        expose-ingress: tenant-root
-        expose-external-ips: "192.0.2.10,192.0.2.11"
-    asserts:
-      - template: templates/nginx-ingress.yaml
-        equal:
-          path: spec.values.ingress-nginx.controller.service.type
-          value: ClusterIP
-      - template: templates/nginx-ingress.yaml
-        equal:
-          path: spec.values.ingress-nginx.controller.service.externalTrafficPolicy
-          value: Cluster
-      - template: templates/nginx-ingress.yaml
-        equal:
-          path: spec.values.ingress-nginx.controller.service.externalIPs
-          value:
-            - 192.0.2.10
-            - 192.0.2.11
-      - template: templates/nginx-ingress.yaml
-        notExists:
-          path: spec.values.ingress-nginx.controller.service.labels
-
-  - it: legacy config without expose-mode falls back to externalIPs behavior
-    set:
-      _cluster:
-        expose-ingress: tenant-root
-        expose-external-ips: "192.0.2.10"
-    asserts:
-      - template: templates/nginx-ingress.yaml
-        equal:
-          path: spec.values.ingress-nginx.controller.service.type
-          value: ClusterIP
-
-  - it: externalIPs mode in a namespace other than publishing.ingressName renders LoadBalancer fallback without externalIPs
-    set:
-      _cluster:
-        expose-ingress: tenant-root
-        expose-external-ips: "192.0.2.10"
-    release:
-      namespace: tenant-other
-    asserts:
-      - template: templates/nginx-ingress.yaml
-        equal:
-          path: spec.values.ingress-nginx.controller.service.type
-          value: LoadBalancer
-      - template: templates/nginx-ingress.yaml
-        equal:
-          path: spec.values.ingress-nginx.controller.service.externalTrafficPolicy
-          value: Local
-      - template: templates/nginx-ingress.yaml
-        notExists:
-          path: spec.values.ingress-nginx.controller.service.externalIPs
-
-  - it: loadBalancer mode renders LoadBalancer Service without externalIPs on the Service
-    set:
-      _cluster:
-        expose-ingress: tenant-root
-        expose-external-ips: "192.0.2.10,192.0.2.11"
-        expose-mode: loadBalancer
-    asserts:
-      - template: templates/nginx-ingress.yaml
-        equal:
-          path: spec.values.ingress-nginx.controller.service.type
-          value: LoadBalancer
-      - template: templates/nginx-ingress.yaml
-        equal:
-          path: spec.values.ingress-nginx.controller.service.externalTrafficPolicy
-          value: Local
-      - template: templates/nginx-ingress.yaml
-        notExists:
-          path: spec.values.ingress-nginx.controller.service.labels
-      - template: templates/nginx-ingress.yaml
-        notExists:
-          path: spec.values.ingress-nginx.controller.service.externalIPs
-
-  - it: loadBalancer mode without externalIPs fails chart render with explicit message
-    set:
-      _cluster:
-        expose-ingress: tenant-root
-        expose-external-ips: ""
-        expose-mode: loadBalancer
-    asserts:
-      - template: templates/nginx-ingress.yaml
-        failedTemplate:
-          errorMessage: "publishing.exposure=loadBalancer requires publishing.externalIPs to contain at least one non-empty address: the CiliumLoadBalancerIPPool has nothing to advertise and the Service would stay in <pending>."
-
-  - it: unknown exposure mode is rejected with a clear error (case-sensitive enum)
-    set:
-      _cluster:
-        expose-ingress: tenant-root
-        expose-external-ips: "192.0.2.10"
-        expose-mode: LoadBalancer
-    asserts:
-      - template: templates/nginx-ingress.yaml
-        failedTemplate:
-          errorMessage: "unknown publishing.exposure mode \"LoadBalancer\": must be \"externalIPs\" or \"loadBalancer\""
-
-  - it: another typo in exposure mode also fails
-    set:
-      _cluster:
-        expose-ingress: tenant-root
-        expose-external-ips: "192.0.2.10"
-        expose-mode: loadbalancer
-    asserts:
-      - template: templates/nginx-ingress.yaml
-        failedTemplate:
-          errorMessage: "unknown publishing.exposure mode \"loadbalancer\": must be \"externalIPs\" or \"loadBalancer\""
-
-  - it: loadBalancer mode in a namespace other than publishing.ingressName falls back to LoadBalancer Service without pool
-    set:
-      _cluster:
-        expose-ingress: tenant-root
-        expose-external-ips: "192.0.2.10"
-        expose-mode: loadBalancer
-    release:
-      namespace: tenant-other
-    asserts:
-      - template: templates/nginx-ingress.yaml
-        equal:
-          path: spec.values.ingress-nginx.controller.service.type
-          value: LoadBalancer
-      - template: templates/nginx-ingress.yaml
-        equal:
-          path: spec.values.ingress-nginx.controller.service.externalTrafficPolicy
-          value: Local
-      - template: templates/nginx-ingress.yaml
-        notExists:
-          path: spec.values.ingress-nginx.controller.service.labels
-      - template: templates/nginx-ingress.yaml
-        notExists:
-          path: spec.values.ingress-nginx.controller.service.externalIPs
-
-  - it: loadBalancer mode with only-empty externalIPs fails chart render (comma-only input)
-    set:
-      _cluster:
-        expose-ingress: tenant-root
-        expose-external-ips: ",,"
-        expose-mode: loadBalancer
-    asserts:
-      - template: templates/nginx-ingress.yaml
-        failedTemplate:
-          errorMessage: "publishing.exposure=loadBalancer requires publishing.externalIPs to contain at least one non-empty address: the CiliumLoadBalancerIPPool has nothing to advertise and the Service would stay in <pending>."
-
-  - it: externalIPs mode also filters out empty entries (trailing comma)
-    set:
-      _cluster:
-        expose-ingress: tenant-root
-        expose-external-ips: "192.0.2.10,"
-    asserts:
-      - template: templates/nginx-ingress.yaml
-        equal:
-          path: spec.values.ingress-nginx.controller.service.externalIPs
-          value:
-            - 192.0.2.10
diff --git a/packages/system/backup-controller/images/backup-controller/Dockerfile b/packages/system/backup-controller/images/backup-controller/Dockerfile
index a48bc4f9..83d7d675 100644
--- a/packages/system/backup-controller/images/backup-controller/Dockerfile
+++ b/packages/system/backup-controller/images/backup-controller/Dockerfile
@@ -1,4 +1,4 @@
-FROM golang:1.25-alpine AS builder
+FROM golang:1.26-alpine AS builder
 
 ARG TARGETOS
 ARG TARGETARCH
@@ -20,4 +20,5 @@ FROM scratch
 COPY --from=builder /backup-controller /backup-controller
 COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
 
+USER 65532:65532
 ENTRYPOINT ["/backup-controller"]
diff --git a/packages/system/backupstrategy-controller/images/backupstrategy-controller/Dockerfile b/packages/system/backupstrategy-controller/images/backupstrategy-controller/Dockerfile
index c4f60746..243cce65 100644
--- a/packages/system/backupstrategy-controller/images/backupstrategy-controller/Dockerfile
+++ b/packages/system/backupstrategy-controller/images/backupstrategy-controller/Dockerfile
@@ -1,4 +1,4 @@
-FROM golang:1.25-alpine AS builder
+FROM golang:1.26-alpine AS builder
 
 ARG TARGETOS
 ARG TARGETARCH
@@ -20,4 +20,5 @@ FROM scratch
 COPY --from=builder /backupstrategy-controller /backupstrategy-controller
 COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
 
+USER 65532:65532
 ENTRYPOINT ["/backupstrategy-controller"]
diff --git a/packages/system/cozy-proxy/charts/cozy-proxy/Chart.yaml b/packages/system/cozy-proxy/charts/cozy-proxy/Chart.yaml
index 58f166f6..13352680 100644
--- a/packages/system/cozy-proxy/charts/cozy-proxy/Chart.yaml
+++ b/packages/system/cozy-proxy/charts/cozy-proxy/Chart.yaml
@@ -2,5 +2,5 @@ apiVersion: v2
 name: cozy-proxy
 description: A simple kube-proxy addon for 1:1 NAT services in Kubernetes using an NFT backend
 type: application
-version: 0.3.0
-appVersion: 0.3.0
+version: 0.2.0
+appVersion: 0.2.0
diff --git a/packages/system/cozy-proxy/charts/cozy-proxy/values.yaml b/packages/system/cozy-proxy/charts/cozy-proxy/values.yaml
index e143e926..8cde5bed 100644
--- a/packages/system/cozy-proxy/charts/cozy-proxy/values.yaml
+++ b/packages/system/cozy-proxy/charts/cozy-proxy/values.yaml
@@ -1,6 +1,6 @@
 image:
   repository: ghcr.io/cozystack/cozystack/cozy-proxy
-  tag: v0.3.0
+  tag: v0.2.0
   pullPolicy: IfNotPresent
 
 daemonset:
diff --git a/packages/system/cozystack-api/images/cozystack-api/Dockerfile b/packages/system/cozystack-api/images/cozystack-api/Dockerfile
index b4b206a6..4ad95485 100644
--- a/packages/system/cozystack-api/images/cozystack-api/Dockerfile
+++ b/packages/system/cozystack-api/images/cozystack-api/Dockerfile
@@ -1,4 +1,4 @@
-FROM golang:1.25-alpine AS builder
+FROM golang:1.26-alpine AS builder
 
 ARG TARGETOS
 ARG TARGETARCH
diff --git a/packages/system/cozystack-controller/images/cozystack-controller/Dockerfile b/packages/system/cozystack-controller/images/cozystack-controller/Dockerfile
index ea475317..acba9e01 100644
--- a/packages/system/cozystack-controller/images/cozystack-controller/Dockerfile
+++ b/packages/system/cozystack-controller/images/cozystack-controller/Dockerfile
@@ -1,4 +1,4 @@
-FROM golang:1.25-alpine AS builder
+FROM golang:1.26-alpine AS builder
 
 ARG TARGETOS
 ARG TARGETARCH
diff --git a/packages/system/dashboard/images/token-proxy/Dockerfile b/packages/system/dashboard/images/token-proxy/Dockerfile
index 5f6c5e2e..3d1e60b1 100644
--- a/packages/system/dashboard/images/token-proxy/Dockerfile
+++ b/packages/system/dashboard/images/token-proxy/Dockerfile
@@ -1,4 +1,4 @@
-FROM golang:1.24-alpine as builder
+FROM golang:1.26-alpine AS builder
 
 ARG TARGETOS
 ARG TARGETARCH
@@ -12,4 +12,5 @@ FROM scratch
 
 COPY --from=builder /token-proxy /token-proxy
 
+USER 65532:65532
 ENTRYPOINT ["/token-proxy"]
diff --git a/packages/system/dashboard/images/token-proxy/go.mod b/packages/system/dashboard/images/token-proxy/go.mod
index 01f15bc8..2b045361 100644
--- a/packages/system/dashboard/images/token-proxy/go.mod
+++ b/packages/system/dashboard/images/token-proxy/go.mod
@@ -1,23 +1,23 @@
 module token-proxy
 
-go 1.24.0
+go 1.26.2
 
 require (
 	github.com/gorilla/securecookie v1.1.2
-	github.com/lestrrat-go/httprc/v3 v3.0.2
-	github.com/lestrrat-go/jwx/v3 v3.0.13
+	github.com/lestrrat-go/httprc/v3 v3.0.5
+	github.com/lestrrat-go/jwx/v3 v3.1.0
 )
 
 require (
-	github.com/decred/dcrd/dcrec/secp256k1/v4 v4.4.0 // indirect
-	github.com/goccy/go-json v0.10.3 // indirect
+	github.com/decred/dcrd/dcrec/secp256k1/v4 v4.4.1 // indirect
+	github.com/goccy/go-json v0.10.6 // indirect
 	github.com/lestrrat-go/blackmagic v1.0.4 // indirect
-	github.com/lestrrat-go/dsig v1.0.0 // indirect
+	github.com/lestrrat-go/dsig v1.2.1 // indirect
 	github.com/lestrrat-go/dsig-secp256k1 v1.0.0 // indirect
 	github.com/lestrrat-go/httpcc v1.0.1 // indirect
 	github.com/lestrrat-go/option/v2 v2.0.0 // indirect
 	github.com/segmentio/asm v1.2.1 // indirect
-	github.com/valyala/fastjson v1.6.7 // indirect
-	golang.org/x/crypto v0.46.0 // indirect
-	golang.org/x/sys v0.39.0 // indirect
+	github.com/valyala/fastjson v1.6.10 // indirect
+	golang.org/x/crypto v0.50.0 // indirect
+	golang.org/x/sys v0.43.0 // indirect
 )
diff --git a/packages/system/dashboard/images/token-proxy/go.sum b/packages/system/dashboard/images/token-proxy/go.sum
index f9f2e7e5..4c75483c 100644
--- a/packages/system/dashboard/images/token-proxy/go.sum
+++ b/packages/system/dashboard/images/token-proxy/go.sum
@@ -1,26 +1,26 @@
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/decred/dcrd/dcrec/secp256k1/v4 v4.4.0 h1:NMZiJj8QnKe1LgsbDayM4UoHwbvwDRwnI3hwNaAHRnc=
-github.com/decred/dcrd/dcrec/secp256k1/v4 v4.4.0/go.mod h1:ZXNYxsqcloTdSy/rNShjYzMhyjf0LaoftYK0p+A3h40=
-github.com/goccy/go-json v0.10.3 h1:KZ5WoDbxAIgm2HNbYckL0se1fHD6rz5j4ywS6ebzDqA=
-github.com/goccy/go-json v0.10.3/go.mod h1:oq7eo15ShAhp70Anwd5lgX2pLfOS3QCiwU/PULtXL6M=
+github.com/decred/dcrd/dcrec/secp256k1/v4 v4.4.1 h1:5RVFMOWjMyRy8cARdy79nAmgYw3hK/4HUq48LQ6Wwqo=
+github.com/decred/dcrd/dcrec/secp256k1/v4 v4.4.1/go.mod h1:ZXNYxsqcloTdSy/rNShjYzMhyjf0LaoftYK0p+A3h40=
+github.com/goccy/go-json v0.10.6 h1:p8HrPJzOakx/mn/bQtjgNjdTcN+/S6FcG2CTtQOrHVU=
+github.com/goccy/go-json v0.10.6/go.mod h1:oq7eo15ShAhp70Anwd5lgX2pLfOS3QCiwU/PULtXL6M=
 github.com/google/gofuzz v1.2.0 h1:xRy4A+RhZaiKjJ1bPfwQ8sedCA+YS2YcCHW6ec7JMi0=
 github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
 github.com/gorilla/securecookie v1.1.2 h1:YCIWL56dvtr73r6715mJs5ZvhtnY73hBvEF8kXD8ePA=
 github.com/gorilla/securecookie v1.1.2/go.mod h1:NfCASbcHqRSY+3a8tlWJwsQap2VX5pwzwo4h3eOamfo=
 github.com/lestrrat-go/blackmagic v1.0.4 h1:IwQibdnf8l2KoO+qC3uT4OaTWsW7tuRQXy9TRN9QanA=
 github.com/lestrrat-go/blackmagic v1.0.4/go.mod h1:6AWFyKNNj0zEXQYfTMPfZrAXUWUfTIZ5ECEUEJaijtw=
-github.com/lestrrat-go/dsig v1.0.0 h1:OE09s2r9Z81kxzJYRn07TFM9XA4akrUdoMwr0L8xj38=
-github.com/lestrrat-go/dsig v1.0.0/go.mod h1:dEgoOYYEJvW6XGbLasr8TFcAxoWrKlbQvmJgCR0qkDo=
+github.com/lestrrat-go/dsig v1.2.1 h1:MwxzZhE4+4fguHi+uDALKVlC3Cn+O1QU1Q/F8D7hVIc=
+github.com/lestrrat-go/dsig v1.2.1/go.mod h1:RD2eOaidyPvpc7IJQoO3Qq52RWdy8ZcJs8lrOnoa1Kc=
 github.com/lestrrat-go/dsig-secp256k1 v1.0.0 h1:JpDe4Aybfl0soBvoVwjqDbp+9S1Y2OM7gcrVVMFPOzY=
 github.com/lestrrat-go/dsig-secp256k1 v1.0.0/go.mod h1:CxUgAhssb8FToqbL8NjSPoGQlnO4w3LG1P0qPWQm/NU=
 github.com/lestrrat-go/httpcc v1.0.1 h1:ydWCStUeJLkpYyjLDHihupbn2tYmZ7m22BGkcvZZrIE=
 github.com/lestrrat-go/httpcc v1.0.1/go.mod h1:qiltp3Mt56+55GPVCbTdM9MlqhvzyuL6W/NMDA8vA5E=
-github.com/lestrrat-go/httprc/v3 v3.0.2 h1:7u4HUaD0NQbf2/n5+fyp+T10hNCsAnwKfqn4A4Baif0=
-github.com/lestrrat-go/httprc/v3 v3.0.2/go.mod h1:mSMtkZW92Z98M5YoNNztbRGxbXHql7tSitCvaxvo9l0=
-github.com/lestrrat-go/jwx/v3 v3.0.13 h1:AdHKiPIYeCSnOJtvdpipPg/0SuFh9rdkN+HF3O0VdSk=
-github.com/lestrrat-go/jwx/v3 v3.0.13/go.mod h1:2m0PV1A9tM4b/jVLMx8rh6rBl7F6WGb3EG2hufN9OQU=
+github.com/lestrrat-go/httprc/v3 v3.0.5 h1:S+Mb4L2I+bM6JGTibLmxExhyTOqnXjqx+zi9MoXw/TM=
+github.com/lestrrat-go/httprc/v3 v3.0.5/go.mod h1:mSMtkZW92Z98M5YoNNztbRGxbXHql7tSitCvaxvo9l0=
+github.com/lestrrat-go/jwx/v3 v3.1.0 h1:AyyLtxc0QM75F75JroWgt1phwC7X+wOb3XKhH7XBZWw=
+github.com/lestrrat-go/jwx/v3 v3.1.0/go.mod h1:uw/MN2M/Xiu4FhwcIwH11Zsh9JWx9SWzgALl7/uIEkU=
 github.com/lestrrat-go/option/v2 v2.0.0 h1:XxrcaJESE1fokHy3FpaQ/cXW8ZsIdWcdFzzLOcID3Ss=
 github.com/lestrrat-go/option/v2 v2.0.0/go.mod h1:oSySsmzMoR0iRzCDCaUfsCzxQHUEuhOViQObyy7S6Vg=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
@@ -31,12 +31,12 @@ github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+
 github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
 github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
-github.com/valyala/fastjson v1.6.7 h1:ZE4tRy0CIkh+qDc5McjatheGX2czdn8slQjomexVpBM=
-github.com/valyala/fastjson v1.6.7/go.mod h1:CLCAqky6SMuOcxStkYQvblddUtoRxhYMGLrsQns1aXY=
-golang.org/x/crypto v0.46.0 h1:cKRW/pmt1pKAfetfu+RCEvjvZkA9RimPbh7bhFjGVBU=
-golang.org/x/crypto v0.46.0/go.mod h1:Evb/oLKmMraqjZ2iQTwDwvCtJkczlDuTmdJXoZVzqU0=
-golang.org/x/sys v0.39.0 h1:CvCKL8MeisomCi6qNZ+wbb0DN9E5AATixKsvNtMoMFk=
-golang.org/x/sys v0.39.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
+github.com/valyala/fastjson v1.6.10 h1:/yjJg8jaVQdYR3arGxPE2X5z89xrlhS0eGXdv+ADTh4=
+github.com/valyala/fastjson v1.6.10/go.mod h1:e6FubmQouUNP73jtMLmcbxS6ydWIpOfhz34TSfO3JaE=
+golang.org/x/crypto v0.50.0 h1:zO47/JPrL6vsNkINmLoo/PH1gcxpls50DNogFvB5ZGI=
+golang.org/x/crypto v0.50.0/go.mod h1:3muZ7vA7PBCE6xgPX7nkzzjiUq87kRItoJQM1Yo8S+Q=
+golang.org/x/sys v0.43.0 h1:Rlag2XtaFTxp19wS8MXlJwTvoh8ArU6ezoyFsMyCTNI=
+golang.org/x/sys v0.43.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
diff --git a/packages/system/flux-plunger/images/flux-plunger/Dockerfile b/packages/system/flux-plunger/images/flux-plunger/Dockerfile
index 37821699..2984840f 100644
--- a/packages/system/flux-plunger/images/flux-plunger/Dockerfile
+++ b/packages/system/flux-plunger/images/flux-plunger/Dockerfile
@@ -1,4 +1,4 @@
-FROM golang:1.25-alpine AS builder
+FROM golang:1.26-alpine AS builder
 
 ARG TARGETOS
 ARG TARGETARCH
@@ -20,4 +20,5 @@ FROM scratch
 COPY --from=builder /flux-plunger /flux-plunger
 COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
 
+USER 65532:65532
 ENTRYPOINT ["/flux-plunger"]
diff --git a/packages/system/gpu-operator/examples/README.md b/packages/system/gpu-operator/examples/README.md
deleted file mode 100644
index b6f170c8..00000000
--- a/packages/system/gpu-operator/examples/README.md
+++ /dev/null
@@ -1,121 +0,0 @@
-# GPU operator — native pod workload on Talos (reference)
-
-The files in this directory are **not** templates. They are reference
-artifacts that document one working configuration for running GPU
-workloads directly in pods on a Talos-based Cozystack cluster, together
-with the DCGM metrics needed by the `gpu/gpu-performance` Grafana
-dashboard.
-
-The out-of-the-box `values-talos.yaml` for this package targets the
-sandbox (VFIO passthrough to KubeVirt VMs) scenario. The files here
-illustrate an alternative — running CUDA workloads in regular pods with
-the NVIDIA device plugin — and the workarounds it currently requires on
-Talos.
-
-## Files
-
-- [`values-native-talos.yaml`](./values-native-talos.yaml) — Cozystack
-  `Package` values that disable sandbox workloads, enable the device
-  plugin, point `hostPaths.driverInstallDir` at the staging location
-  used by the compat DaemonSet, and wire DCGM to the custom metrics
-  ConfigMap.
-- [`dcgm-custom-metrics.yaml`](./dcgm-custom-metrics.yaml) — `ConfigMap`
-  with a DCGM metrics CSV that adds profiling, ECC, throttling and
-  energy counters on top of the upstream defaults. The CSV is a
-  superset needed for full coverage of the `gpu/gpu-performance`
-  dashboard. Which parts are actually required depends on which
-  dashboards you ship — see the table below.
-- [`nvidia-driver-compat.yaml`](./nvidia-driver-compat.yaml) — DaemonSet
-  that stages `libnvidia-ml.so.1` and `nvidia-smi` from the Talos glibc
-  tree into a path where the NVIDIA GPU Operator validator expects
-  them. See the "Why the compat DaemonSet exists" section below.
-
-## Why these are reference, not templates
-
-Shipping these as first-class templates would silently impose
-assumptions that do not hold for every user:
-
-- Whether the NVIDIA Talos system extension is installed on the nodes.
-- Whether GPUs are exposed directly to pods or passed through to VMs.
-- The exact path the installed driver ends up at (depends on the
-  extension version and Talos release).
-
-The sandbox-oriented `values-talos.yaml` remains the default. Operators
-who want native pod GPU workloads can start from this directory and
-adapt as needed.
-
-## Why the compat DaemonSet exists
-
-The NVIDIA GPU Operator validator checks for `libnvidia-ml.so.1` and
-`bin/nvidia-smi` in the path given by `hostPaths.driverInstallDir`.
-Talos installs them under `/usr/local/glibc/usr/lib/` and
-`/usr/local/bin/`, which the validator does not look at. Until upstream
-addresses [NVIDIA/gpu-operator#1687][1], the DaemonSet copies those
-files into a directory the validator does inspect and creates the
-`.driver-ctr-ready` flag file so the validator proceeds.
-
-[1]: https://github.com/NVIDIA/gpu-operator/issues/1687
-
-The compat DaemonSet runs privileged and bind-mounts host paths, so
-the target namespace must allow privileged pods. On clusters that
-enforce the Kubernetes Pod Security Standards at `baseline` or
-`restricted`, label the namespace with
-`pod-security.kubernetes.io/enforce: privileged` (and the matching
-`audit`/`warn` labels if the admission webhook is configured to
-surface violations) before applying the manifest.
-
-## Dashboards and what DCGM metrics they need
-
-Five GPU dashboards live under `gpu/*` in
-`packages/system/monitoring/dashboards-infra.list`. All of them share
-`packages/system/monitoring-agents/alerts/gpu-recording.rules.yaml` as
-their source of aggregated series. The recording rules are safe to
-ship on any cluster — they evaluate to empty series when DCGM is not
-scraped, or when optional counters are missing.
-
-What each dashboard needs on top of the upstream DCGM Exporter
-[`default-counters.csv`][default-csv]:
-
-| Dashboard         | Scope                              | Needs beyond defaults                                                   |
-| ----------------- | ---------------------------------- | ----------------------------------------------------------------------- |
-| `gpu-performance` | Per-node, per-GPU deep dive        | `DCGM_FI_DEV_POWER_VIOLATION`, `DCGM_FI_DEV_THERMAL_VIOLATION`          |
-| `gpu-efficiency`  | Per-workload util vs tensor active | `DCGM_FI_DEV_POWER_VIOLATION`, `DCGM_FI_DEV_THERMAL_VIOLATION` (via `gpu:*_throttle_fraction:rate5m` recording rules) |
-| `gpu-fleet`       | Cluster-wide admin inventory       | `DCGM_FI_DEV_POWER_MGMT_LIMIT` (for the TDP vs draw panel)              |
-| `gpu-quotas`      | Kube-quota vs live usage           | `kube_pod_container_resource_requests`, `kube_pod_status_phase`, `kube_node_status_allocatable` (via `namespace:gpu_count:allocated` / `cluster:gpu_count:*` recording rules) |
-| `gpu-tenants`     | Per-namespace tenant view          | nothing (works on default counters)                                     |
-
-`DCGM_FI_PROF_PIPE_TENSOR_ACTIVE` and `DCGM_FI_PROF_GR_ENGINE_ACTIVE`
-are already in the upstream default set for the pinned DCGM Exporter
-version, so the tensor-saturation and engine-active panels work without
-any CSV override. The three counters listed in the table — throttling
-violations and the power management limit — are the only extras the
-tracked dashboards need. The recording rules in
-`gpu-recording.rules.yaml` consume utilization, FB used, power,
-temperature and the tensor-active profiling counter from the default
-set, plus `DCGM_FI_DEV_POWER_VIOLATION` and
-`DCGM_FI_DEV_THERMAL_VIOLATION` — used by the
-`gpu.recording.efficiency.1m` group to derive the
-`gpu:power_throttle_fraction:rate5m` and
-`gpu:thermal_throttle_fraction:rate5m` series consumed by the
-throttling panels on the efficiency and fleet dashboards.
-
-The `gpu.recording.throttle.validation.5m` group additionally ships the
-`GPUThrottleFractionOverOne` alert (severity `warning`) as a regression
-detector: it fires when either throttle-fraction series exceeds 1.0,
-which would indicate that DCGM changed the scale/divisor of the
-underlying violation counters and the recording rules need to be
-re-derived.
-
-## Verification status
-
-The minimum-CSV claims above are verified by
-`hack/check-gpu-recording-rules.bats`, which cross-checks every
-`DCGM_FI_*` reference in the tracked GPU dashboards and recording rules
-against the union of the upstream default set (snapshotted at
-`hack/dcgm-default-counters.csv` for the pinned DCGM Exporter version)
-and the custom CSV in `dcgm-custom-metrics.yaml`. When the DCGM
-Exporter image in `packages/system/gpu-operator/charts/gpu-operator/values.yaml`
-is bumped, refresh the snapshot from the matching tag of the
-[`NVIDIA/dcgm-exporter`][default-csv] repository and rerun the test.
-
-[default-csv]: https://github.com/NVIDIA/dcgm-exporter/blob/main/etc/default-counters.csv
diff --git a/packages/system/gpu-operator/examples/dcgm-custom-metrics.yaml b/packages/system/gpu-operator/examples/dcgm-custom-metrics.yaml
deleted file mode 100644
index ef2b0b88..00000000
--- a/packages/system/gpu-operator/examples/dcgm-custom-metrics.yaml
+++ /dev/null
@@ -1,88 +0,0 @@
-# Custom DCGM Exporter metrics CSV. Referenced from
-# examples/values-native-talos.yaml via dcgmExporter.config.name.
-#
-# Extends the upstream default set with profiling counters, ECC, page
-# retirement, row remap, energy and throttling violations — everything
-# the gpu/gpu-performance dashboard and the GPU recording rules in
-# monitoring-agents expect.
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: dcgm-custom-metrics
-  namespace: cozy-gpu-operator
-data:
-  dcgm-metrics.csv: |
-    # Format
-    # If line starts with a '#' it is considered a comment
-    # DCGM FIELD, Prometheus metric type, help message
-
-    # Identity
-    DCGM_FI_DRIVER_VERSION, label, Driver version.
-
-    # Clocks
-    DCGM_FI_DEV_SM_CLOCK,  gauge, SM clock frequency (in MHz).
-    DCGM_FI_DEV_MEM_CLOCK, gauge, Memory clock frequency (in MHz).
-
-    # Temperature
-    DCGM_FI_DEV_MEMORY_TEMP, gauge, Memory temperature (in C).
-    DCGM_FI_DEV_GPU_TEMP,    gauge, GPU temperature (in C).
-
-    # Power
-    DCGM_FI_DEV_POWER_USAGE,              gauge, Power draw (in W).
-    DCGM_FI_DEV_POWER_MGMT_LIMIT,         gauge, Current power management limit (in W).
-    DCGM_FI_DEV_TOTAL_ENERGY_CONSUMPTION, counter, Total energy consumption since boot (in mJ).
-
-    # PCIE
-    DCGM_FI_DEV_PCIE_REPLAY_COUNTER, counter, Total number of PCIe retries.
-
-    # Utilization (the sample period varies depending on the product)
-    DCGM_FI_DEV_GPU_UTIL,      gauge, GPU utilization (in %).
-    DCGM_FI_DEV_MEM_COPY_UTIL, gauge, Memory utilization (in %).
-    DCGM_FI_DEV_ENC_UTIL,      gauge, Encoder utilization (in %).
-    DCGM_FI_DEV_DEC_UTIL,      gauge, Decoder utilization (in %).
-
-    # Errors and violations
-    DCGM_FI_DEV_XID_ERRORS, gauge, Value of the last XID error encountered.
-
-    # Memory usage
-    DCGM_FI_DEV_FB_FREE,     gauge, Framebuffer memory free (in MiB).
-    DCGM_FI_DEV_FB_USED,     gauge, Framebuffer memory used (in MiB).
-    DCGM_FI_DEV_FB_RESERVED, gauge, Framebuffer memory reserved (in MiB).
-
-    # ECC (supported on datacenter-class GPUs such as A10)
-    DCGM_FI_DEV_ECC_SBE_VOL_TOTAL, counter, Total number of single-bit volatile ECC errors.
-    DCGM_FI_DEV_ECC_DBE_VOL_TOTAL, counter, Total number of double-bit volatile ECC errors.
-    DCGM_FI_DEV_ECC_SBE_AGG_TOTAL, counter, Total number of single-bit persistent ECC errors.
-    DCGM_FI_DEV_ECC_DBE_AGG_TOTAL, counter, Total number of double-bit persistent ECC errors.
-
-    # Retired pages
-    DCGM_FI_DEV_RETIRED_SBE,     counter, Total number of retired pages due to single-bit errors.
-    DCGM_FI_DEV_RETIRED_DBE,     counter, Total number of retired pages due to double-bit errors.
-    DCGM_FI_DEV_RETIRED_PENDING, counter, Total number of pages pending retirement.
-
-    # Row remapping (not applicable to GDDR6 but left for datacenter GPUs)
-    DCGM_FI_DEV_UNCORRECTABLE_REMAPPED_ROWS, counter, Number of remapped rows for uncorrectable errors.
-    DCGM_FI_DEV_CORRECTABLE_REMAPPED_ROWS,   counter, Number of remapped rows for correctable errors.
-    DCGM_FI_DEV_ROW_REMAP_FAILURE,           gauge,   Whether remapping of rows has failed.
-
-    # Throttle / violation counters (crucial for SLA and tenant monitoring)
-    DCGM_FI_DEV_POWER_VIOLATION,       counter, Throttling duration due to power constraints (us per docs; ns on DCGM 3.x).
-    DCGM_FI_DEV_THERMAL_VIOLATION,     counter, Throttling duration due to thermal constraints (us per docs; ns on DCGM 3.x).
-    DCGM_FI_DEV_SYNC_BOOST_VIOLATION,  counter, Throttling duration due to sync-boost constraints (us per docs; ns on DCGM 3.x).
-    DCGM_FI_DEV_BOARD_LIMIT_VIOLATION, counter, Throttling duration due to board limit constraints (us per docs; ns on DCGM 3.x).
-    DCGM_FI_DEV_LOW_UTIL_VIOLATION,    counter, Throttling duration due to low utilization (us per docs; ns on DCGM 3.x).
-    DCGM_FI_DEV_RELIABILITY_VIOLATION, counter, Throttling duration due to reliability constraints (us per docs; ns on DCGM 3.x).
-
-    # NVLink — DCGM silently drops this metric on GPUs without NVLink, so
-    # enabling it unconditionally is safe and keeps this file reusable
-    # across GPU families.
-    DCGM_FI_DEV_NVLINK_BANDWIDTH_TOTAL, counter, Total number of NVLink bandwidth counters for all lanes.
-
-    # DCP (profiling) metrics — supported from Ampere onwards.
-    DCGM_FI_PROF_GR_ENGINE_ACTIVE,   gauge, Ratio of time the graphics engine is active.
-    DCGM_FI_PROF_SM_ACTIVE,          gauge, The ratio of cycles an SM has at least 1 warp assigned.
-    DCGM_FI_PROF_SM_OCCUPANCY,       gauge, The ratio of number of warps resident on an SM.
-    DCGM_FI_PROF_PIPE_TENSOR_ACTIVE, gauge, Ratio of cycles the tensor (HMMA) pipe is active.
-    DCGM_FI_PROF_DRAM_ACTIVE,        gauge, Ratio of cycles the device memory interface is active sending or receiving data.
-    DCGM_FI_PROF_PCIE_TX_BYTES,      counter, The number of bytes of active PCIe tx (transmit) data including both header and payload.
-    DCGM_FI_PROF_PCIE_RX_BYTES,      counter, The number of bytes of active PCIe rx (read) data including both header and payload.
diff --git a/packages/system/gpu-operator/examples/nvidia-driver-compat.yaml b/packages/system/gpu-operator/examples/nvidia-driver-compat.yaml
deleted file mode 100644
index fc9d5981..00000000
--- a/packages/system/gpu-operator/examples/nvidia-driver-compat.yaml
+++ /dev/null
@@ -1,109 +0,0 @@
-# Workaround for https://github.com/NVIDIA/gpu-operator/issues/1687
-#
-# On Talos, the NVIDIA system extension installs driver files under
-# /usr/local/glibc/usr/lib/ and /usr/local/bin/. The GPU Operator
-# validator only looks for libnvidia-ml.so.1 and bin/nvidia-smi under
-# the path configured as hostPaths.driverInstallDir. This DaemonSet
-# stages the required files into /var/nvidia-driver on each node and
-# creates the .driver-ctr-ready flag so the validator proceeds.
-#
-# Paired with examples/values-native-talos.yaml, which sets
-# hostPaths.driverInstallDir to /var/nvidia-driver.
-apiVersion: apps/v1
-kind: DaemonSet
-metadata:
-  name: nvidia-driver-compat
-  namespace: cozy-gpu-operator
-  labels:
-    app: nvidia-driver-compat
-spec:
-  selector:
-    matchLabels:
-      app: nvidia-driver-compat
-  template:
-    metadata:
-      labels:
-        app: nvidia-driver-compat
-    # DaemonSet rather than a one-shot Job: staging is idempotent per-node,
-    # must re-run after every Talos reboot (hostPath contents are wiped on
-    # reboot when the system extension re-installs), and the pause container
-    # keeps the pod visible for operator observability (kubectl get pods).
-    spec:
-      priorityClassName: system-node-critical
-      # Restrict to GPU nodes only. Without this the DaemonSet schedules onto
-      # every node (including control-plane and CPU-only workers) and burns
-      # resources on hosts where the compat tree is meaningless.
-      # The label is published by Node Feature Discovery / GPU Operator's NFD
-      # subchart; if NFD is disabled, replace this with whatever label your
-      # cluster uses to mark GPU hosts.
-      nodeSelector:
-        nvidia.com/gpu.present: "true"
-      # Tolerate-all is intentionally broad: the nodeSelector above already
-      # confines scheduling to GPU nodes, so the "Exists" toleration only
-      # matters when those nodes carry extra taints (dedicated=gpu:NoSchedule,
-      # nvidia.com/gpu:NoSchedule from the GPU Operator's default policy,
-      # etc.). This mirrors the stance of the upstream nvidia-driver-daemonset
-      # and nvidia-device-plugin DaemonSets — blanket tolerations plus a
-      # narrow nodeSelector.
-      tolerations:
-        - operator: Exists
-      initContainers:
-        - name: create-driver-tree
-          image: busybox:1.37
-          command:
-            - sh
-            - -c
-            - |
-              set -e
-              GLIBC_LIB="/host/usr/local/glibc/usr/lib"
-              SRC_BIN="/host/usr/local/bin"
-              DST="/host/var/nvidia-driver"
-
-              mkdir -p "$DST/bin"
-
-              [ -f "$GLIBC_LIB/libnvidia-ml.so.1" ] || {
-                echo "missing $GLIBC_LIB/libnvidia-ml.so.1" >&2
-                exit 1
-              }
-              [ -f "$SRC_BIN/nvidia-smi" ] || {
-                echo "missing $SRC_BIN/nvidia-smi" >&2
-                exit 1
-              }
-
-              cp -f "$GLIBC_LIB/libnvidia-ml.so.1" "$DST/libnvidia-ml.so.1"
-              echo "Copied libnvidia-ml.so.1"
-
-              cp -f "$SRC_BIN/nvidia-smi" "$DST/bin/nvidia-smi"
-              chmod +x "$DST/bin/nvidia-smi"
-              echo "Copied nvidia-smi"
-
-              mkdir -p /host/run/nvidia/validations
-              touch /host/run/nvidia/validations/.driver-ctr-ready
-              echo "Created driver-ctr-ready flag"
-              echo "Done"
-          securityContext:
-            privileged: true
-          resources:
-            requests:
-              cpu: 10m
-              memory: 16Mi
-            limits:
-              cpu: 100m
-              memory: 64Mi
-          volumeMounts:
-            - name: host-root
-              mountPath: /host
-      containers:
-        - name: pause
-          image: registry.k8s.io/pause:3.10
-          resources:
-            requests:
-              cpu: 10m
-              memory: 8Mi
-            limits:
-              cpu: 50m
-              memory: 16Mi
-      volumes:
-        - name: host-root
-          hostPath:
-            path: /
diff --git a/packages/system/gpu-operator/examples/values-native-talos.yaml b/packages/system/gpu-operator/examples/values-native-talos.yaml
deleted file mode 100644
index ef7b2891..00000000
--- a/packages/system/gpu-operator/examples/values-native-talos.yaml
+++ /dev/null
@@ -1,52 +0,0 @@
-# Cozystack Package values for running GPU workloads natively in pods
-# on Talos. This is the counterpart to values-talos.yaml, which targets
-# the sandbox (VFIO passthrough) scenario.
-#
-# Prerequisites:
-#   - NVIDIA Talos system extension installed on GPU nodes.
-#   - examples/nvidia-driver-compat.yaml deployed to stage driver files
-#     where the gpu-operator validator looks for them.
-#   - examples/dcgm-custom-metrics.yaml applied so DCGM Exporter exports
-#     the full set of metrics used by the dashboard and recording rules.
-apiVersion: cozystack.io/v1alpha1
-kind: Package
-metadata:
-  name: cozystack.gpu-operator
-spec:
-  variant: default
-  components:
-    gpu-operator:
-      values:
-        gpu-operator:
-          # The compat DaemonSet stages libnvidia-ml.so.1 and nvidia-smi
-          # under /var/nvidia-driver. Point the validator at that path.
-          hostPaths:
-            driverInstallDir: "/var/nvidia-driver"
-          # Disable the sandbox path — workloads run in pods, not VMs.
-          sandboxWorkloads:
-            enabled: false
-          vfioManager:
-            enabled: false
-          # The Talos extension provides the driver and runtime hooks,
-          # so the operator's own toolkit and driver components must be
-          # switched off to avoid conflicting installations.
-          toolkit:
-            enabled: false
-          devicePlugin:
-            enabled: true
-          # Export full set of DCGM metrics using the ConfigMap in
-          # examples/dcgm-custom-metrics.yaml.
-          dcgmExporter:
-            serviceMonitor:
-              enabled: true
-              # Matches the 1m evaluation cadence of GPU recording rules with
-              # 4x oversampling headroom. DCGM_FI_PROF_* counters have
-              # documented overhead concerns below 1s; 15s is safe.
-              interval: "15s"
-              honorLabels: true
-              relabelings:
-                - sourceLabels: [__meta_kubernetes_pod_node_name]
-                  targetLabel: node
-                  action: replace
-            config:
-              name: dcgm-custom-metrics
diff --git a/packages/system/hami/Chart.yaml b/packages/system/hami/Chart.yaml
deleted file mode 100644
index 3fcf4c5d..00000000
--- a/packages/system/hami/Chart.yaml
+++ /dev/null
@@ -1,3 +0,0 @@
-apiVersion: v2
-name: cozy-hami
-version: 0.0.0 # Placeholder, the actual version will be automatically set during the build process
diff --git a/packages/system/hami/Makefile b/packages/system/hami/Makefile
deleted file mode 100644
index 83663a66..00000000
--- a/packages/system/hami/Makefile
+++ /dev/null
@@ -1,43 +0,0 @@
-export NAME=hami
-export NAMESPACE=cozy-$(NAME)
-
-include ../../../hack/common-envs.mk
-include ../../../hack/package.mk
-
-# When bumping the HAMi version, run `make update` and then review
-# the resulting diff in `charts/hami/`. The recipe below reproduces the
-# top-level vendoring overrides automatically:
-#
-#   1. Removes the broken hami-dra subchart. Upstream's NVIDIA DRA driver
-#      path requires kubelet DRA support that cozystack does not enable
-#      and has no upstream fix tracked. See commit 3c5521e.
-#   2. Empties Chart.yaml dependencies and drops Chart.lock so Helm does
-#      not try to re-pull hami-dra at build time. See commit 2734dc0.
-#   3. Strips dra/hami-dra/podSecurityPolicy blocks from the upstream
-#      values.yaml since the corresponding code paths are gone. PSP is
-#      removed from Kubernetes 1.25+ and is unused by cozystack.
-#
-# Template-level patches are NOT reproduced automatically:
-#
-#   * Scheduler templates have `{{- if .Values.dra.enabled }}` blocks
-#     that need to be removed because the dra value is gone (commit
-#     2734dc0 stripped them).
-#   * device-plugin/monitorservice.yaml uses `indent` with leading
-#     whitespace; it must be rewritten to `nindent` for the labels block
-#     to render correctly when devicePlugin.service.labels is set
-#     (commit 3685254).
-#
-# After `make update`, run `git diff -- charts/hami/templates/` and
-# replay these template patches against the new upstream version, then
-# verify with `helm unittest`. If upstream restructured the affected
-# files, the patches may need to be redesigned rather than reapplied.
-
-update:
-	rm -rf charts
-	helm repo add hami-charts https://project-hami.github.io/HAMi/
-	helm repo update hami-charts
-	helm pull hami-charts/hami --untar --untardir charts
-	rm -rf charts/hami/charts/hami-dra
-	yq --inplace '.dependencies = []' charts/hami/Chart.yaml
-	rm -f charts/hami/Chart.lock
-	yq --inplace 'del(.dra) | del(.["hami-dra"]) | del(.podSecurityPolicy)' charts/hami/values.yaml
diff --git a/packages/system/hami/README.md b/packages/system/hami/README.md
deleted file mode 100644
index 68669ac7..00000000
--- a/packages/system/hami/README.md
+++ /dev/null
@@ -1,82 +0,0 @@
-# HAMi — GPU Virtualization Middleware
-
-[HAMi](https://github.com/Project-HAMi/HAMi) (Heterogeneous AI Computing Virtualization Middleware) is a CNCF Sandbox project that enables fractional GPU sharing in Kubernetes. It allows workloads to request specific amounts of GPU memory and compute cores instead of claiming entire GPUs.
-
-## Architecture
-
-HAMi consists of four components:
-
-- **MutatingWebhook** — intercepts pod creation, injects `schedulerName: hami-scheduler`
-- **Scheduler Extender** — extends kube-scheduler with GPU-aware Filter and Bind logic
-- **Device Plugin** (DaemonSet) — registers vGPU resources via the Kubernetes Device Plugin API
-- **HAMi-core** (`libvgpu.so`) — `LD_PRELOAD` library injected into workload containers, intercepts CUDA API calls to enforce memory and compute isolation
-
-## Prerequisites
-
-- GPU Operator must be enabled (`addons.gpuOperator.enabled: true`)
-- NVIDIA driver >= 440 on host nodes
-- nvidia-container-toolkit configured as the default container runtime
-- GPU nodes labeled with `gpu=on`
-
-## Known Limitations
-
-### glibc < 2.34 requirement for workload containers
-
-HAMi-core uses `LD_PRELOAD` to intercept `dlsym()` for CUDA symbol resolution. The fallback code path relies on `_dl_sym`, a private glibc internal symbol that was removed in glibc 2.34 when libdl and libpthread were merged into libc.so.
-
-**This limitation affects workload containers only**, not the host OS or HAMi's own components.
-
-| Distribution    | glibc | Result                                       |
-| --------------- | ----- | -------------------------------------------- |
-| Ubuntu 18.04    | 2.27  | Full isolation (memory + compute)            |
-| Ubuntu 20.04    | 2.31  | Full isolation (memory + compute)            |
-| Ubuntu 22.04    | 2.35  | Memory isolation works, compute breaks       |
-| Ubuntu 24.04    | 2.39  | Both memory and compute isolation break      |
-| Alpine (musl)   | N/A   | Completely incompatible (`dlvsym` absent)    |
-
-Most modern ML/AI base images (CUDA 12.x, PyTorch 2.x, TensorFlow 2.x) use Ubuntu 22.04+ with glibc >= 2.35, which means compute isolation will not work with these images until the upstream fix is merged.
-
-**Upstream tracking issues:**
-
-- [HAMi-core#174](https://github.com/Project-HAMi/HAMi-core/issues/174) — `_dl_sym` removal in glibc 2.34 breaks HAMi-core's CUDA symbol resolution at the symbol level
-- [HAMi#1190](https://github.com/Project-HAMi/HAMi/issues/1190) — maintainer thread confirming the empirical per-glibc-version isolation behavior shown in the table above
-
-### musl libc (Alpine) incompatibility
-
-HAMi-core is completely incompatible with musl libc. The `dlvsym()` function used by HAMi-core is a glibc extension not available in musl. Only glibc-based container images (Debian, Ubuntu, RHEL, etc.) can use HAMi GPU isolation.
-
-## Usage
-
-Enable HAMi in your tenant Kubernetes cluster values:
-
-```yaml
-addons:
-  gpuOperator:
-    enabled: true
-  hami:
-    enabled: true
-```
-
-When HAMi is enabled, GPU Operator's built-in device plugin is automatically disabled to avoid conflicts. This default is preserved by setting `addons.gpuOperator.valuesOverride.gpu-operator.devicePlugin.enabled: false`; advanced topologies that partition GPU pools (e.g. some nodes use HAMi while others run the standard NVIDIA device plugin via node selectors) can re-enable it explicitly through `valuesOverride`.
-
-### Requesting fractional GPU resources
-
-```yaml
-resources:
-  limits:
-    nvidia.com/gpu: 1
-    nvidia.com/gpumem: 3000     # 3000 MB of GPU memory
-    nvidia.com/gpucores: 30     # 30% of GPU compute cores
-```
-
-## Parameters
-
-Default values shown below are inherited from the upstream HAMi chart and may change with upstream updates.
-
-| Name | Description | Default |
-| --- | --- | --- |
-| `hami.devicePlugin.runtimeClassName` | RuntimeClass for device plugin pods | `nvidia` |
-| `hami.devicePlugin.deviceSplitCount` | Max virtual GPUs per physical GPU | `10` |
-| `hami.devicePlugin.deviceMemoryScaling` | Memory overcommit factor (> 1.0 enables overcommit) | `1` |
-| `hami.scheduler.defaultSchedulerPolicy.nodeSchedulerPolicy` | Node packing strategy (`binpack` or `spread`) | `binpack` |
-| `hami.scheduler.defaultSchedulerPolicy.gpuSchedulerPolicy` | GPU packing strategy (`binpack` or `spread`) | `spread` |
diff --git a/packages/system/hami/charts/hami/Chart.yaml b/packages/system/hami/charts/hami/Chart.yaml
deleted file mode 100644
index 55f32ab6..00000000
--- a/packages/system/hami/charts/hami/Chart.yaml
+++ /dev/null
@@ -1,18 +0,0 @@
-apiVersion: v2
-appVersion: 2.8.1
-dependencies: []
-description: Heterogeneous AI Computing Virtualization Middleware
-keywords:
-- vgpu
-- gpu
-kubeVersion: '>= 1.18.0-0'
-maintainers:
-- email: archlitchi@gmail.com
-  name: limengxuan
-- email: xiaozhang0210@hotmail.com
-  name: zhangxiao
-name: hami
-sources:
-- https://github.com/Project-HAMi/HAMi
-type: application
-version: 2.8.1
diff --git a/packages/system/hami/charts/hami/README.md b/packages/system/hami/charts/hami/README.md
deleted file mode 100644
index e8217290..00000000
--- a/packages/system/hami/charts/hami/README.md
+++ /dev/null
@@ -1,237 +0,0 @@
-# HAMi Helm Chart Values Documentation
-
-This document provides detailed descriptions of all configurable values parameters for the HAMi Helm Chart.
-
-## Global Configuration
-
-| Parameter | Description | Default Value |
-|-----------|-------------|---------------|
-| `global.imageRegistry` | Global Docker image registry | `""` |
-| `global.imagePullSecrets` | Global Docker image pull secrets | `[]` |
-| `global.imageTag` | Image tag | `"v2.8.1"` |
-| `global.gpuHookPath` | GPU Hook path | `/usr/local` |
-| `global.labels` | Global labels | `{}` |
-| `global.annotations` | Global annotations | `{}` |
-| `global.managedNodeSelectorEnable` | Whether to enable managed node selector | `false` |
-| `global.managedNodeSelector.usage` | Managed node selector usage | `"gpu"` |
-| `nameOverride` | Name override | `""` |
-| `fullnameOverride` | Full name override | `""` |
-| `namespaceOverride` | Namespace override | `""` |
-
-## Resource Name Configuration
-
-### NVIDIA GPU Resources
-| Parameter | Description | Default Value |
-|-----------|-------------|---------------|
-| `resourceName` | GPU resource name | `"nvidia.com/gpu"` |
-| `resourceMem` | GPU memory resource name | `"nvidia.com/gpumem"` |
-| `resourceMemPercentage` | GPU memory percentage resource name | `"nvidia.com/gpumem-percentage"` |
-| `resourceCores` | GPU core resource name | `"nvidia.com/gpucores"` |
-| `resourcePriority` | GPU priority resource name | `"nvidia.com/priority"` |
-
-### Cambricon MLU Resources
-| Parameter | Description | Default Value |
-|-----------|-------------|---------------|
-| `mluResourceName` | MLU resource name | `"cambricon.com/vmlu"` |
-| `mluResourceMem` | MLU memory resource name | `"cambricon.com/mlu.smlu.vmemory"` |
-| `mluResourceCores` | MLU core resource name | `"cambricon.com/mlu.smlu.vcore"` |
-
-### Hygon DCU Resources
-| Parameter | Description | Default Value |
-|-----------|-------------|---------------|
-| `dcuResourceName` | DCU resource name | `"hygon.com/dcunum"` |
-| `dcuResourceMem` | DCU memory resource name | `"hygon.com/dcumem"` |
-| `dcuResourceCores` | DCU core resource name | `"hygon.com/dcucores"` |
-
-### Metax GPU Resources
-| Parameter | Description | Default Value |
-|-----------|-------------|---------------|
-| `metaxResourceName` | GPU resource name | `"metax-tech.com/sgpu"` |
-| `metaxResourceCore` | GPU core resource name | `"metax-tech.com/vcore"` |
-| `metaxResourceMem` | GPU memory resource name | `"metax-tech.com/vmemory"` |
-| `metaxsGPUTopologyAware` | GPU topology awareness | `"false"` |
-
-### Enflame GCU Resources
-| Parameter | Description | Default Value |
-|-----------|-------------|---------------|
-| `enflameResourceNameVGCU` | vGCU resource name | `"enflame.com/vgcu"` |
-| `enflameResourceNameVGCUPercentage` | vGCU percentage resource name | `"enflame.com/vgcu-percentage"` |
-
-### Kunlunxin XPU Resources
-| Parameter | Description | Default Value |
-|-----------|-------------|---------------|
-| `kunlunResourceName` | XPU resource name | `"kunlunxin.com/xpu"` |
-
-## Scheduler Configuration
-
-| Parameter | Description | Default Value |
-|-----------|-------------|---------------|
-| `schedulerName` | Scheduler name | `"hami-scheduler"` |
-| `scheduler.nodeName` | Define node name, scheduler will schedule to this node | `""` |
-| `scheduler.overwriteEnv` | Whether to overwrite environment variables | `"false"` |
-| `scheduler.defaultSchedulerPolicy.nodeSchedulerPolicy` | Node scheduler policy | `binpack` |
-| `scheduler.defaultSchedulerPolicy.gpuSchedulerPolicy` | GPU scheduler policy | `spread` |
-| `scheduler.metricsBindAddress` | Metrics bind address | `":9395"` |
-| `scheduler.forceOverwriteDefaultScheduler` | Whether to force overwrite default scheduler | `true` |
-| `scheduler.livenessProbe` | Whether to enable liveness probe | `false` |
-| `scheduler.leaderElect` | Whether to enable leader election | `true` |
-| `scheduler.replicas` | Number of replicas | `1` |
-
-### Kube Scheduler Configuration
-
-| Parameter | Description | Default Value |
-|-----------|-------------|---------------|
-| `scheduler.kubeScheduler.enabled` | Whether to run kube-scheduler container in scheduler pod | `true` |
-| `scheduler.kubeScheduler.image.registry` | Kube scheduler image registry | `"registry.cn-hangzhou.aliyuncs.com"` |
-| `scheduler.kubeScheduler.image.repository` | Kube scheduler image repository | `"google_containers/kube-scheduler"` |
-| `scheduler.kubeScheduler.image.tag` | Kube scheduler image tag | `""` |
-| `scheduler.kubeScheduler.image.pullPolicy` | Kube scheduler image pull policy | `IfNotPresent` |
-| `scheduler.kubeScheduler.image.pullSecrets` | Kube scheduler image pull secrets | `[]` |
-| `scheduler.kubeScheduler.extraNewArgs` | Extra new arguments | `["--config=/config/config.yaml", "-v=4"]` |
-| `scheduler.kubeScheduler.extraArgs` | Extra arguments | `["--policy-config-file=/config/config.json", "-v=4"]` |
-
-### Extender Configuration
-
-| Parameter | Description | Default Value |
-|-----------|-------------|---------------|
-| `scheduler.extender.image.registry` | Scheduler extender image registry | `"docker.io"` |
-| `scheduler.extender.image.repository` | Scheduler extender image repository | `"projecthami/hami"` |
-| `scheduler.extender.image.tag` | Scheduler extender image tag | `""` |
-| `scheduler.extender.image.pullPolicy` | Scheduler extender image pull policy | `IfNotPresent` |
-| `scheduler.extender.image.pullSecrets` | Scheduler extender image pull secrets | `[]` |
-| `scheduler.extender.extraArgs` | Scheduler extender extra arguments | `["--debug", "-v=4"]` |
-
-### Admission Webhook Configuration
-
-| Parameter | Description | Default Value |
-|-----------|-------------|---------------|
-| `scheduler.admissionWebhook.enabled` | Whether to enable admission webhook | `true` |
-| `scheduler.admissionWebhook.customURL.enabled` | Whether to enable custom URL | `false` |
-| `scheduler.admissionWebhook.customURL.host` | Custom URL host | `127.0.0.1` |
-| `scheduler.admissionWebhook.customURL.port` | Custom URL port | `31998` |
-| `scheduler.admissionWebhook.customURL.path` | Custom URL path | `/webhook` |
-| `scheduler.admissionWebhook.reinvocationPolicy` | Reinvocation policy | `Never` |
-| `scheduler.admissionWebhook.failurePolicy` | Failure policy | `Ignore` |
-
-### TLS Certificate Configuration
-
-| Parameter | Description | Default Value |
-|-----------|-------------|---------------|
-| `scheduler.certManager.enabled` | Whether to use cert-manager to generate self-signed certificates | `false` |
-| `scheduler.patch.enabled` | Whether to use kube-webhook-certgen to generate self-signed certificates | `true` |
-| `scheduler.patch.image.registry` | Certgen image registry | `"docker.io"` |
-| `scheduler.patch.image.repository` | Certgen image repository | `"jettech/kube-webhook-certgen"` |
-| `scheduler.patch.image.tag` | Certgen image tag | `"v1.5.2"` |
-| `scheduler.patch.image.pullPolicy` | Certgen image pull policy | `IfNotPresent` |
-| `scheduler.patch.imageNew.registry` | New certgen image registry | `"docker.io"` |
-| `scheduler.patch.imageNew.repository` | New certgen image repository | `"liangjw/kube-webhook-certgen"` |
-| `scheduler.patch.imageNew.tag` | New certgen image tag | `"v1.1.1"` |
-
-### Scheduler Service Configuration
-
-| Parameter | Description | Default Value |
-|-----------|-------------|---------------|
-| `scheduler.service.type` | Service type | `NodePort` |
-| `scheduler.service.httpPort` | HTTP port | `443` |
-| `scheduler.service.schedulerPort` | Scheduler NodePort | `31998` |
-| `scheduler.service.monitorPort` | Monitor port | `31993` |
-| `scheduler.service.monitorTargetPort` | Monitor target port | `9395` |
-
-## Device Plugin Configuration
-
-| Parameter | Description | Default Value |
-|-----------|-------------|---------------|
-| `devicePlugin.image.registry` | Device plugin image registry | `"docker.io"` |
-| `devicePlugin.image.repository` | Device plugin image repository | `"projecthami/hami"` |
-| `devicePlugin.image.tag` | Device plugin image tag | `""` |
-| `devicePlugin.image.pullPolicy` | Device plugin image pull policy | `IfNotPresent` |
-| `devicePlugin.image.pullSecrets` | Device plugin image pull secrets | `[]` |
-
-### Monitor Configuration
-
-| Parameter | Description | Default Value |
-|-----------|-------------|---------------|
-| `devicePlugin.monitor.image.registry` | Monitor image registry | `"docker.io"` |
-| `devicePlugin.monitor.image.repository` | Monitor image repository | `"projecthami/hami"` |
-| `devicePlugin.monitor.image.tag` | Monitor image tag | `""` |
-| `devicePlugin.monitor.image.pullPolicy` | Monitor image pull policy | `IfNotPresent` |
-| `devicePlugin.monitor.image.pullSecrets` | Monitor image pull secrets | `[]` |
-| `devicePlugin.monitor.ctrPath` | Container path | `/usr/local/vgpu/containers` |
-| `devicePlugin.monitor.extraArgs` | Monitor extra arguments | `["-v=4"]` |
-| `devicePlugin.monitor.extraEnvs` | Monitor extra environments | `{}` |
-
-### Device Plugin Other Configuration
-
-| Parameter | Description | Default Value |
-|-----------|-------------|---------------|
-| `devicePlugin.deviceSplitCount` | Integer type, default value: 10. Maximum number of tasks assigned to a single GPU device | `10` |
-| `devicePlugin.deviceMemoryScaling` | Device memory scaling ratio | `1` |
-| `devicePlugin.deviceCoreScaling` | Device core scaling ratio | `1` |
-| `devicePlugin.runtimeClassName` | Runtime class name | `""` |
-| `devicePlugin.createRuntimeClass` | Whether to create runtime class | `false` |
-| `devicePlugin.migStrategy` | String type, "none" means ignore MIG functionality, "mixed" means allocate MIG devices through independent resources | `"none"` |
-| `devicePlugin.disablecorelimit` | String type, "true" means disable core limit, "false" means enable core limit | `"false"` |
-| `devicePlugin.passDeviceSpecsEnabled` | Whether to enable passing device specs | `false` |
-| `devicePlugin.extraArgs` | Device plugin extra arguments | `["-v=4"]` |
-| `devicePlugin.nodeConfiguration.config` | Node configuration for device plugin by json | An example of default configuration. |
-| `devicePlugin.nodeConfiguration.externalConfigName` | Node configuration for device plugin by external congimap | `""` |
-| `devicePlugin.extraEnvs` | Device plugin extra environments | `{}` |
-
-### Device Plugin Service Configuration
-
-| Parameter | Description | Default Value |
-|-----------|-------------|---------------|
-| `devicePlugin.service.type` | Service type | `NodePort` |
-| `devicePlugin.service.httpPort` | HTTP port | `31992` |
-
-### Device Plugin Deployment Configuration
-
-| Parameter | Description | Default Value |
-|-----------|-------------|---------------|
-| `devicePlugin.pluginPath` | Plugin path | `/var/lib/kubelet/device-plugins` |
-| `devicePlugin.libPath` | Library path | `/usr/local/vgpu` |
-| `devicePlugin.nvidiaNodeSelector` | NVIDIA node selector | `{"gpu": "on"}` |
-| `devicePlugin.updateStrategy.type` | Update strategy type | `RollingUpdate` |
-| `devicePlugin.updateStrategy.rollingUpdate.maxUnavailable` | Maximum unavailable count | `1` |
-
-## Device Configuration
-
-### AWS Neuron
-| Parameter | Description | Default Value |
-|-----------|-------------|---------------|
-| `devices.awsneuron.customresources` | Custom resources | `["aws.amazon.com/neuron", "aws.amazon.com/neuroncore"]` |
-
-### Kunlunxin
-| Parameter | Description | Default Value |
-|-----------|-------------|---------------|
-| `devices.kunlun.enabled` | Whether to enable | `true` |
-| `devices.kunlun.customresources` | Custom resources | `["kunlunxin.com/xpu"]` |
-
-### Mthreads
-| Parameter | Description | Default Value |
-|-----------|-------------|---------------|
-| `devices.mthreads.enabled` | Whether to enable | `true` |
-| `devices.mthreads.customresources` | Custom resources | `["mthreads.com/vgpu"]` |
-
-### NVIDIA
-| Parameter | Description | Default Value |
-|-----------|-------------|---------------|
-| `devices.nvidia.gpuCorePolicy` | GPU core policy | `default` |
-| `devices.nvidia.libCudaLogLevel` | CUDA library log level | `1` |
-
-### Huawei Ascend
-| Parameter | Description | Default Value |
-|-----------|-------------|---------------|
-| `devices.ascend.enabled` | Whether to enable | `false` |
-| `devices.ascend.image` | Image | `""` |
-| `devices.ascend.imagePullPolicy` | Image pull policy | `IfNotPresent` |
-| `devices.ascend.extraArgs` | Extra arguments | `[]` |
-| `devices.ascend.nodeSelector` | Node selector | `{"ascend": "on"}` |
-| `devices.ascend.tolerations` | Tolerations | `[]` |
-| `devices.ascend.customresources` | Custom resources | `["huawei.com/Ascend910A", "huawei.com/Ascend910A-memory", ...]` |
-
-### Iluvatar
-| Parameter | Description | Default Value |
-|-----------|-------------|---------------|
-| `devices.iluvatar.enabled` | Whether to enable | `false` |
-| `devices.iluvatar.customresources` | Custom resources | `["iluvatar.ai/BI-V150-vgpu", "iluvatar.ai/BI-V150.vMem","iluvatar.ai/BI-V150.vCore", ...]` |
diff --git a/packages/system/hami/charts/hami/templates/NOTES.txt b/packages/system/hami/charts/hami/templates/NOTES.txt
deleted file mode 100644
index 15bb1218..00000000
--- a/packages/system/hami/charts/hami/templates/NOTES.txt
+++ /dev/null
@@ -1,3 +0,0 @@
-** Please be patient while the chart is being deployed **
-Resource name: {{ .Values.resourceName }}
-
diff --git a/packages/system/hami/charts/hami/templates/_commons.tpl b/packages/system/hami/charts/hami/templates/_commons.tpl
deleted file mode 100644
index b68018e4..00000000
--- a/packages/system/hami/charts/hami/templates/_commons.tpl
+++ /dev/null
@@ -1,49 +0,0 @@
-{{/*
-Return the proper image name
-{{ include "common.images.image" ( dict "imageRoot" .Values.path.to.the.image "global" $) }}
-*/}}
-{{- define "common.images.image" -}}
-{{- $registryName := .imageRoot.registry -}}
-{{- $repositoryName := .imageRoot.repository -}}
-{{- $tag := .imageRoot.tag | toString -}}
-{{- if .global }}
-    {{- if .global.imageRegistry }}
-     {{- $registryName = .global.imageRegistry -}}
-    {{- end -}}
-{{- end -}}
-{{- if .tag }}
-     {{- $tag = .tag | toString -}}
-{{- end -}}
-{{- if $registryName }}
-{{- printf "%s/%s:%s" $registryName $repositoryName $tag -}}
-{{- else -}}
-{{- printf "%s:%s" $repositoryName $tag -}}
-{{- end -}}
-{{- end -}}
-
-{{/*
-Return the proper Docker Image Registry Secret Names (deprecated: use common.images.renderPullSecrets instead)
-{{ include "common.images.pullSecrets" ( dict "images" (list .Values.path.to.the.image1, .Values.path.to.the.image2) "global" .Values.global) }}
-*/}}
-{{- define "common.images.pullSecrets" -}}
-  {{- $pullSecrets := list }}
-
-  {{- if .global }}
-    {{- range .global.imagePullSecrets -}}
-      {{- $pullSecrets = append $pullSecrets . -}}
-    {{- end -}}
-  {{- end -}}
-
-  {{- range .images -}}
-    {{- range .pullSecrets -}}
-      {{- $pullSecrets = append $pullSecrets . -}}
-    {{- end -}}
-  {{- end -}}
-
-  {{- if (not (empty $pullSecrets)) }}
-imagePullSecrets:
-    {{- range $pullSecrets }}
-  - name: {{ . }}
-    {{- end }}
-  {{- end }}
-{{- end -}}
diff --git a/packages/system/hami/charts/hami/templates/_helpers.tpl b/packages/system/hami/charts/hami/templates/_helpers.tpl
deleted file mode 100644
index ffcc61da..00000000
--- a/packages/system/hami/charts/hami/templates/_helpers.tpl
+++ /dev/null
@@ -1,163 +0,0 @@
-{{/*
-Expand the name of the chart.
-*/}}
-{{- define "hami-vgpu.name" -}}
-{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
-{{- end -}}
-
-{{/*
-Create a default fully qualified app name.
-We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
-If release name contains chart name it will be used as a full name.
-*/}}
-{{- define "hami-vgpu.fullname" -}}
-{{- if .Values.fullnameOverride -}}
-{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
-{{- else }}
-{{- $name := default .Chart.Name .Values.nameOverride -}}
-{{- if contains $name .Release.Name }}
-{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
-{{- else -}}
-{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
-{{- end -}}
-{{- end -}}
-{{- end -}}
-
-{{/*
-Allow the release namespace to be overridden for multi-namespace deployments in combined charts
-*/}}
-{{- define "hami-vgpu.namespace" -}}
-  {{- if .Values.namespaceOverride -}}
-    {{- .Values.namespaceOverride -}}
-  {{- else -}}
-    {{- .Release.Namespace -}}
-  {{- end -}}
-{{- end -}}
-
-{{/*
-The app name for Scheduler
-*/}}
-{{- define "hami-vgpu.scheduler" -}}
-{{- printf "%s-scheduler" ( include "hami-vgpu.fullname" . ) | trunc 63 | trimSuffix "-" -}}
-{{- end -}}
-
-{{/*
-The app name for DevicePlugin
-*/}}
-{{- define "hami-vgpu.device-plugin" -}}
-{{- printf "%s-device-plugin" ( include "hami-vgpu.fullname" . ) | trunc 63 | trimSuffix "-" -}}
-{{- end -}}
-
-{{/*
-  The app name for MockDevicePlugin
-  */}}
-{{- define "hami-vgpu.mock-device-plugin" -}}
-{{- printf "%s-mock-device-plugin" ( include "hami-vgpu.fullname" . ) | trunc 63 | trimSuffix "-" -}}
-{{- end -}}
-
-{{/*
-The tls secret name for Scheduler
-*/}}
-{{- define "hami-vgpu.scheduler.tls" -}}
-{{- printf "%s-scheduler-tls" ( include "hami-vgpu.fullname" . ) | trunc 63 | trimSuffix "-" -}}
-{{- end -}}
-
-{{/*
-The webhook name
-*/}}
-{{- define "hami-vgpu.scheduler.webhook" -}}
-{{- printf "%s-webhook" ( include "hami-vgpu.fullname" . ) | trunc 63 | trimSuffix "-" -}}
-{{- end -}}
-
-{{/*
-Create chart name and version as used by the chart label.
-*/}}
-{{- define "hami-vgpu.chart" -}}
-{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
-{{- end }}
-
-{{/*
-Common labels
-*/}}
-{{- define "hami-vgpu.labels" -}}
-helm.sh/chart: {{ include "hami-vgpu.chart" . }}
-{{ include "hami-vgpu.selectorLabels" . }}
-{{- if .Chart.AppVersion }}
-app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
-{{- end }}
-app.kubernetes.io/managed-by: {{ .Release.Service }}
-{{- end }}
-
-{{/*
-Selector labels
-*/}}
-{{- define "hami-vgpu.selectorLabels" -}}
-app.kubernetes.io/name: {{ include "hami-vgpu.name" . }}
-app.kubernetes.io/instance: {{ .Release.Name }}
-{{- end }}
-
-
-{{/*
-    Resolve the tag for kubeScheduler.
-*/}}
-{{- define "resolvedKubeSchedulerTag" -}}
-{{- if .Values.scheduler.kubeScheduler.image.tag }}
-{{- .Values.scheduler.kubeScheduler.image.tag | trim -}}
-{{- else }}
-{{- include "strippedKubeVersion" . | trim -}}
-{{- end }}
-{{- end }}
-
-{{/*
-    Return the stripped Kubernetes version string by removing extra parts after semantic version number.
-    v1.31.1+k3s1 -> v1.31.1
-    v1.30.8-eks-2d5f260 -> v1.30.8
-    v1.31.1 -> v1.31.1
-*/}}
-{{- define "strippedKubeVersion" -}}
-{{ regexReplaceAll "^(v[0-9]+\\.[0-9]+\\.[0-9]+)(.*)$" .Capabilities.KubeVersion.Version "$1" }}
-{{- end -}}
-
-{{- define "hami.scheduler.kubeScheduler.image" -}}
-{{ include "common.images.image" (dict "imageRoot" .Values.scheduler.kubeScheduler.image "global" .Values.global "tag" (include "resolvedKubeSchedulerTag" .)) }}
-{{- end -}}
-
-{{- define "hami.scheduler.extender.image" -}}
-{{ include "common.images.image" (dict "imageRoot" .Values.scheduler.extender.image "global" .Values.global "tag" .Values.global.imageTag) }}
-{{- end -}}
-
-{{- define "hami.devicePlugin.image" -}}
-{{ include "common.images.image" (dict "imageRoot" .Values.devicePlugin.image "global" .Values.global "tag" .Values.global.imageTag) }}
-{{- end -}}
-
-{{- define "hami.mockDevicePlugin.image" -}}
-{{ include "common.images.image" (dict "imageRoot" .Values.mockDevicePlugin.image "global" .Values.global "tag" .Values.mockDevicePlugin.tag) }}
-{{- end -}}
-
-{{- define "hami.devicePlugin.monitor.image" -}}
-{{ include "common.images.image" (dict "imageRoot" .Values.devicePlugin.monitor.image "global" .Values.global "tag" .Values.global.imageTag) }}
-{{- end -}}
-
-{{- define "hami.scheduler.patch.image" -}}
-{{ include "common.images.image" (dict "imageRoot" .Values.scheduler.patch.image "global" .Values.global) }}
-{{- end -}}
-
-{{- define "hami.scheduler.patch.new.image" -}}
-{{ include "common.images.image" (dict "imageRoot" .Values.scheduler.patch.imageNew "global" .Values.global) }}
-{{- end -}}
-
-{{- define "hami.scheduler.extender.imagePullSecrets" -}}
-{{ include "common.images.pullSecrets" (dict "images" (list .Values.scheduler.extender.image) "global" .Values.global) }}
-{{- end -}}
-
-{{- define "hami.devicePlugin.imagePullSecrets" -}}
-{{ include "common.images.pullSecrets" (dict "images" (list .Values.devicePlugin.image) "global" .Values.global) }}
-{{- end -}}
-
-{{- define "hami.scheduler.patch.imagePullSecrets" -}}
-{{ include "common.images.pullSecrets" (dict "images" (list .Values.scheduler.patch.image) "global" .Values.global) }}
-{{- end -}}
-
-{{- define "hami.scheduler.patch.new.imagePullSecrets" -}}
-{{ include "common.images.pullSecrets" (dict "images" (list .Values.scheduler.patch.imageNew) "global" .Values.global) }}
-{{- end -}}
diff --git a/packages/system/hami/charts/hami/templates/device-plugin/configmap.yaml b/packages/system/hami/charts/hami/templates/device-plugin/configmap.yaml
deleted file mode 100644
index 74631e24..00000000
--- a/packages/system/hami/charts/hami/templates/device-plugin/configmap.yaml
+++ /dev/null
@@ -1,13 +0,0 @@
-{{- if and .Values.devicePlugin.enabled (not .Values.devicePlugin.nodeConfiguration.externalConfigName) -}}
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: {{ include "hami-vgpu.device-plugin" . }}
-  namespace: {{ include "hami-vgpu.namespace" . }}
-  labels:
-    app.kubernetes.io/component: hami-device-plugin
-    {{- include "hami-vgpu.labels" . | nindent 4 }}
-data:
-  config.json: |
-{{- .Values.devicePlugin.nodeConfiguration.config | nindent 4 }}
-{{- end }}
diff --git a/packages/system/hami/charts/hami/templates/device-plugin/daemonsetmock.yaml b/packages/system/hami/charts/hami/templates/device-plugin/daemonsetmock.yaml
deleted file mode 100644
index a0dc4ff3..00000000
--- a/packages/system/hami/charts/hami/templates/device-plugin/daemonsetmock.yaml
+++ /dev/null
@@ -1,55 +0,0 @@
-{{- if .Values.mockDevicePlugin.enabled }}
-apiVersion: apps/v1
-kind: DaemonSet
-metadata:
-  name: {{ include "hami-vgpu.mock-device-plugin" . }}
-  namespace: {{ include "hami-vgpu.namespace" . }}
-spec:
-  selector:
-    matchLabels:
-      app.kubernetes.io/component: hami-mock-device-plugin
-      {{- include "hami-vgpu.selectorLabels" . | nindent 6 }}
-  template:
-    metadata:
-      annotations:
-        scheduler.alpha.kubernetes.io/critical-pod: ""
-      labels:
-        app.kubernetes.io/component: hami-mock-device-plugin
-        {{- include "hami-vgpu.selectorLabels" . | nindent 8 }}
-    spec:
-      serviceAccountName: {{ include "hami-vgpu.mock-device-plugin" . }}
-      tolerations:
-      - key: CriticalAddonsOnly
-        operator: Exists
-      containers:
-      - image: {{ include "hami.mockDevicePlugin.image" . }}
-        imagePullPolicy: {{ .Values.mockDevicePlugin.image.pullPolicy }}
-        name: hami-mock-dp-cntr
-        env:
-          - name: NODE_NAME
-            valueFrom:
-              fieldRef:
-                fieldPath: spec.nodeName
-        command:
-          - ./k8s-device-plugin
-          - -v=5
-          - --device-config-file=/device-config.yaml
-        volumeMounts:
-          - name: dp
-            mountPath: /var/lib/kubelet/device-plugins
-          - name: sys
-            mountPath: /sys
-          - name: device-config
-            mountPath: /device-config.yaml
-            subPath: device-config.yaml
-      volumes:
-        - name: dp
-          hostPath:
-            path: /var/lib/kubelet/device-plugins
-        - name: sys
-          hostPath:
-            path: /sys
-        - name: device-config
-          configMap:
-            name: {{ include "hami-vgpu.scheduler" . }}-device
-{{- end -}}
diff --git a/packages/system/hami/charts/hami/templates/device-plugin/daemonsetnvidia.yaml b/packages/system/hami/charts/hami/templates/device-plugin/daemonsetnvidia.yaml
deleted file mode 100644
index 1f4c24f3..00000000
--- a/packages/system/hami/charts/hami/templates/device-plugin/daemonsetnvidia.yaml
+++ /dev/null
@@ -1,262 +0,0 @@
-{{- if .Values.devicePlugin.enabled }}
-apiVersion: apps/v1
-kind: DaemonSet
-metadata:
-  name: {{ include "hami-vgpu.device-plugin" . }}
-  namespace: {{ include "hami-vgpu.namespace" . }}
-  labels:
-    app.kubernetes.io/component: hami-device-plugin
-    {{- include "hami-vgpu.labels" . | nindent 4 }}
-    {{- with .Values.global.labels }}
-    {{- toYaml . | nindent 4 }}
-    {{- end }}
-  {{- if .Values.global.annotations }}
-  annotations: {{ toYaml .Values.global.annotations | nindent 4}}
-  {{- end }}
-spec:
-  updateStrategy:
-    {{- with .Values.devicePlugin.updateStrategy }}
-    {{- toYaml . | nindent 4 }}
-    {{- end }}
-  selector:
-    matchLabels:
-      app.kubernetes.io/component: hami-device-plugin
-      {{- include "hami-vgpu.selectorLabels" . | nindent 6 }}
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/component: hami-device-plugin
-        hami.io/webhook: ignore
-        {{- include "hami-vgpu.selectorLabels" . | nindent 8 }}
-      annotations:
-        {{- if ge (regexReplaceAll "[^0-9]" .Capabilities.KubeVersion.Minor "" | int) 22 }}
-        checksum/hami-scheduler-newversion-config: {{ include (print $.Template.BasePath "/scheduler/configmapnew.yaml") . | sha256sum }}
-        {{- else }}
-        checksum/hami-scheduler-config: {{ include (print $.Template.BasePath "/scheduler/configmap.yaml") . | sha256sum }}
-        {{- end }}
-        checksum/hami-scheduler-device-config: {{ include (print $.Template.BasePath "/scheduler/device-configmap.yaml") . | sha256sum }}
-      {{- if .Values.devicePlugin.podAnnotations }}
-        {{- toYaml .Values.devicePlugin.podAnnotations | nindent 8 }}
-      {{- end }}
-    spec:
-      {{- if .Values.devicePlugin.runtimeClassName }}
-      runtimeClassName: {{ .Values.devicePlugin.runtimeClassName }}
-      {{- end }}
-      serviceAccountName: {{ include "hami-vgpu.device-plugin" . }}
-      priorityClassName: system-node-critical
-      hostPID: true
-      hostNetwork: true
-      {{- include "hami.devicePlugin.imagePullSecrets" . | nindent 6 }}
-      {{- if .Values.devicePlugin.gpuOperatorToolkitReady.enabled }}
-      initContainers:
-        - name: toolkit-validation
-          image: {{ include "hami.devicePlugin.image" . }}
-          imagePullPolicy: {{ .Values.devicePlugin.image.pullPolicy }}
-          securityContext:
-            privileged: true
-            runAsUser: 0
-          command: ["sh", "-c"]
-          args:
-            - |
-              echo "Waiting for NVIDIA Toolkit to be ready..."
-              until [ -f {{ .Values.devicePlugin.gpuOperatorToolkitReady.hostPath }}/toolkit-ready ]; do 
-                echo "Waiting for {{ .Values.devicePlugin.gpuOperatorToolkitReady.hostPath }}/toolkit-ready..."
-                sleep 5
-              done
-              echo "NVIDIA Toolkit is ready!"
-          volumeMounts:
-            - name: nvidia-validations
-              mountPath: {{ .Values.devicePlugin.gpuOperatorToolkitReady.hostPath | quote }}
-              mountPropagation: HostToContainer
-              readOnly: true
-      {{- end }}
-      containers:
-        - name: device-plugin
-          image: {{ include "hami.devicePlugin.image" . }}
-          imagePullPolicy: {{ .Values.devicePlugin.image.pullPolicy }}
-          lifecycle:
-            postStart:
-              exec:
-                command: ["/bin/sh","-c", {{ printf "/k8s-vgpu/bin/vgpu-init.sh %s/vgpu/" .Values.global.gpuHookPath | quote }}]
-          command:
-            - nvidia-device-plugin
-            - --config-file=/device-config.yaml
-            - --mig-strategy={{ .Values.devicePlugin.migStrategy }}
-            - --disable-core-limit={{ .Values.devicePlugin.disablecorelimit }}
-            {{- range .Values.devicePlugin.extraArgs }}
-            - {{ . }}
-            {{- end }}
-          env:
-            - name: NODE_NAME
-              valueFrom:
-                fieldRef:
-                  fieldPath: spec.nodeName
-            - name: NVIDIA_MIG_MONITOR_DEVICES
-              value: all
-            - name: DEVICE_LIST_STRATEGY
-              value: {{ .Values.devicePlugin.deviceListStrategy }}
-            - name: HOOK_PATH
-              value: {{ .Values.global.gpuHookPath }}
-            {{- if typeIs "bool" .Values.devicePlugin.passDeviceSpecsEnabled }}
-            - name: PASS_DEVICE_SPECS
-              value: {{ .Values.devicePlugin.passDeviceSpecsEnabled | quote }}
-            {{- end }}
-            {{- if typeIs "string" .Values.devicePlugin.nvidiaDriverRoot }}
-            - name: NVIDIA_DRIVER_ROOT
-              value: {{ .Values.devicePlugin.nvidiaDriverRoot }}
-            {{- end }}
-            {{- if typeIs "string" .Values.devicePlugin.nvidiaHookPath }}
-            - name: NVIDIA_CDI_HOOK_PATH
-              value: {{ .Values.devicePlugin.nvidiaHookPath }}
-            {{- end }}
-            {{- if typeIs "bool" .Values.devicePlugin.gdrcopyEnabled }}
-            - name: GDRCOPY_ENABLED
-              value: {{ .Values.devicePlugin.gdrcopyEnabled | quote }}
-            {{- end }}
-            {{- if typeIs "bool" .Values.devicePlugin.gdsEnabled }}
-            - name: GDS_ENABLED
-              value: {{ .Values.devicePlugin.gdsEnabled | quote }}
-            {{- end }}
-            {{- if typeIs "bool" .Values.devicePlugin.mofedEnabled }}
-            - name: MOFED_ENABLED
-              value: {{ .Values.devicePlugin.mofedEnabled | quote }}
-            {{- end }}
-            {{- if eq (.Values.scheduler.defaultSchedulerPolicy.gpuSchedulerPolicy | default "spread")  "topology-aware" }}
-            - name: ENABLE_TOPOLOGY_SCORE
-              value: "true"
-            {{- end }}
-            {{- with .Values.devicePlugin.extraEnvs }}
-            {{- . | toYaml | nindent 12 }}
-            {{- end }}
-          securityContext:
-            privileged: true
-            allowPrivilegeEscalation: true
-            capabilities:
-              drop: ["ALL"]
-              add: ["SYS_ADMIN"]
-          resources:
-          {{- toYaml .Values.devicePlugin.resources | nindent 12 }}
-          volumeMounts:
-            - name: device-plugin
-              mountPath: /var/lib/kubelet/device-plugins
-            - name: lib
-              mountPath: {{ printf "%s%s" .Values.global.gpuHookPath "/vgpu" }}
-            - name: usrbin
-              mountPath: /usrbin
-            - name: deviceconfig
-              mountPath: /config
-            - name: hosttmp
-              mountPath: /tmp
-            - name: device-config
-              mountPath: /device-config.yaml
-              subPath: device-config.yaml
-            - name: cdi-root
-              mountPath: /var/run/cdi
-            {{- if typeIs "string" .Values.devicePlugin.nvidiaDriverRoot }}
-            # We always mount the driver root at /driver-root in the container.
-            # This is required for CDI detection to work correctly.
-            - name: driver-root
-              mountPath: /driver-root
-              readOnly: true
-            {{- end }}
-        - name: vgpu-monitor
-          image: {{ include "hami.devicePlugin.monitor.image" . }}
-          imagePullPolicy: {{ .Values.devicePlugin.monitor.image.pullPolicy }}
-          command:
-            - "vGPUmonitor"
-            {{- range .Values.devicePlugin.monitor.extraArgs }}
-            - {{ . }}
-            {{- end }}
-          securityContext:
-            allowPrivilegeEscalation: false
-            capabilities:
-              drop: ["ALL"]
-              add: ["SYS_ADMIN"]
-          env:
-            - name: NODE_NAME
-              valueFrom:
-                fieldRef:
-                  fieldPath: spec.nodeName
-            - name: NVIDIA_VISIBLE_DEVICES
-              value: "all"
-            - name: NVIDIA_MIG_MONITOR_DEVICES
-              value: "all"
-            - name: HOOK_PATH
-              value: "{{ .Values.global.gpuHookPath }}/vgpu"
-            - name: HAMI_RESYNC_INTERVAL
-              value: {{ .Values.devicePlugin.monitor.resyncInterval | default "5m" | quote }}
-            {{- with .Values.devicePlugin.monitor.extraEnvs }}
-            {{- . | toYaml | nindent 12 }}
-            {{- end }}
-          resources:
-          {{- toYaml .Values.devicePlugin.monitor.resources | nindent 12 }}
-          volumeMounts:
-            - name: ctrs
-              mountPath: {{ .Values.devicePlugin.monitor.ctrPath }}
-            - name: dockers
-              mountPath: /run/docker
-            - name: containerds
-              mountPath: /run/containerd
-            - name: sysinfo
-              mountPath: /sysinfo
-            - name: hostvar
-              mountPath: /hostvar
-            - name: hosttmp
-              mountPath: /tmp
-      volumes:
-        - name: ctrs
-          hostPath:
-            path: {{ .Values.devicePlugin.monitor.ctrPath }}
-        - name: hosttmp
-          hostPath:
-            path: /tmp
-        - name: dockers
-          hostPath:
-            path: /run/docker
-        - name: containerds
-          hostPath:
-            path: /run/containerd
-        - name: device-plugin
-          hostPath:
-            path: {{ .Values.devicePlugin.pluginPath }}
-        - name: lib
-          hostPath:
-            path: {{ .Values.devicePlugin.libPath }}
-        {{- if .Values.devicePlugin.gpuOperatorToolkitReady.enabled }}
-        - name: nvidia-validations
-          hostPath:
-            path: {{ .Values.devicePlugin.gpuOperatorToolkitReady.hostPath }}
-            type: DirectoryOrCreate
-        {{- end }}
-        {{- if typeIs "string" .Values.devicePlugin.nvidiaDriverRoot }}
-        - name: driver-root
-          hostPath:
-            path: {{ .Values.devicePlugin.nvidiaDriverRoot }}
-            type: Directory
-        {{- end }}
-        - name: cdi-root
-          hostPath:
-            path: /var/run/cdi
-            type: DirectoryOrCreate
-        - name: usrbin
-          hostPath:
-            path: /usr/bin
-        - name: sysinfo
-          hostPath:
-            path: /sys
-        - name: hostvar
-          hostPath:
-            path: /var
-        - name: deviceconfig
-          configMap:
-            name: {{ .Values.devicePlugin.nodeConfiguration.externalConfigName | default (include "hami-vgpu.device-plugin" .) }}
-        - name: device-config
-          configMap:
-            name: {{ include "hami-vgpu.scheduler" . }}-device
-      {{- if .Values.devicePlugin.nvidiaNodeSelector }}
-      nodeSelector: {{ toYaml .Values.devicePlugin.nvidiaNodeSelector | nindent 8 }}
-      {{- end }}
-      {{- if .Values.devicePlugin.tolerations }}
-      tolerations: {{ toYaml .Values.devicePlugin.tolerations | nindent 8 }}
-      {{- end }}
-{{- end }}
diff --git a/packages/system/hami/charts/hami/templates/device-plugin/monitorrole.yaml b/packages/system/hami/charts/hami/templates/device-plugin/monitorrole.yaml
deleted file mode 100644
index 6ac757f2..00000000
--- a/packages/system/hami/charts/hami/templates/device-plugin/monitorrole.yaml
+++ /dev/null
@@ -1,28 +0,0 @@
-{{- if .Values.devicePlugin.enabled -}}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name:  {{ include "hami-vgpu.device-plugin" . }}-monitor
-rules:
-  - apiGroups:
-      - ""
-    resources:
-      - pods
-    verbs:
-      - get
-      - create
-      - watch
-      - list
-      - update
-      - patch
-  - apiGroups:
-      - ""
-    resources:
-      - nodes
-    verbs:
-      - get
-      - update
-      - list
-      - patch
-{{- end -}}
-
diff --git a/packages/system/hami/charts/hami/templates/device-plugin/monitorrolebinding.yaml b/packages/system/hami/charts/hami/templates/device-plugin/monitorrolebinding.yaml
deleted file mode 100644
index 2f0a14ba..00000000
--- a/packages/system/hami/charts/hami/templates/device-plugin/monitorrolebinding.yaml
+++ /dev/null
@@ -1,17 +0,0 @@
-{{- if .Values.devicePlugin.enabled -}}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: {{ include "hami-vgpu.device-plugin" . }}
-  labels:
-    app.kubernetes.io/component: "hami-device-plugin"
-    {{- include "hami-vgpu.labels" . | nindent 4 }}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: {{ include "hami-vgpu.device-plugin" . }}-monitor
-subjects:
-  - kind: ServiceAccount
-    name: {{ include "hami-vgpu.device-plugin" . }}
-    namespace: {{ include "hami-vgpu.namespace" . }}
-{{- end -}}
diff --git a/packages/system/hami/charts/hami/templates/device-plugin/monitorservice.yaml b/packages/system/hami/charts/hami/templates/device-plugin/monitorservice.yaml
deleted file mode 100644
index 88f1b214..00000000
--- a/packages/system/hami/charts/hami/templates/device-plugin/monitorservice.yaml
+++ /dev/null
@@ -1,29 +0,0 @@
-{{- if .Values.devicePlugin.enabled -}}
-apiVersion: v1
-kind: Service
-metadata:
-  name: {{ include "hami-vgpu.device-plugin" . }}-monitor
-  namespace: {{ include "hami-vgpu.namespace" . }}
-  labels:
-    app.kubernetes.io/component: hami-device-plugin
-    {{- include "hami-vgpu.labels" . | nindent 4 }}
-    {{- with .Values.devicePlugin.service.labels }}
-    {{- toYaml . | nindent 4 }}
-    {{- end }}
-  {{- if .Values.devicePlugin.service.annotations }}  # Use devicePlugin instead of scheduler
-  annotations: {{ toYaml .Values.devicePlugin.service.annotations | nindent 4 }}
-  {{- end }}
-spec:
-  type: {{ .Values.devicePlugin.service.type | default "NodePort" }}  # Default type is NodePort
-  ports:
-    - name: monitorport
-      port: {{ .Values.devicePlugin.service.httpPort | default 31992 }}  # Default HTTP port is 31992
-      targetPort: 9394
-      {{- if eq (.Values.devicePlugin.service.type | default "NodePort") "NodePort" }}  # If type is NodePort, set nodePort
-      nodePort: {{ .Values.devicePlugin.service.httpPort | default 31992 }}
-      {{- end }}
-      protocol: TCP
-  selector:
-    app.kubernetes.io/component: hami-device-plugin
-    {{- include "hami-vgpu.selectorLabels" . | nindent 4 }}
-{{- end -}}
diff --git a/packages/system/hami/charts/hami/templates/device-plugin/monitorserviceaccount.yaml b/packages/system/hami/charts/hami/templates/device-plugin/monitorserviceaccount.yaml
deleted file mode 100644
index 6e3c2a44..00000000
--- a/packages/system/hami/charts/hami/templates/device-plugin/monitorserviceaccount.yaml
+++ /dev/null
@@ -1,10 +0,0 @@
-{{- if .Values.devicePlugin.enabled -}}
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: {{ include "hami-vgpu.device-plugin" . }}
-  namespace: {{ include "hami-vgpu.namespace" . }}
-  labels:
-    app.kubernetes.io/component: "hami-device-plugin"
-    {{- include "hami-vgpu.labels" . | nindent 4 }}
-{{- end -}}
diff --git a/packages/system/hami/charts/hami/templates/device-plugin/runtime-class.yaml b/packages/system/hami/charts/hami/templates/device-plugin/runtime-class.yaml
deleted file mode 100644
index ebcc2c9c..00000000
--- a/packages/system/hami/charts/hami/templates/device-plugin/runtime-class.yaml
+++ /dev/null
@@ -1,9 +0,0 @@
-{{- if and .Values.devicePlugin.enabled .Values.devicePlugin.createRuntimeClass .Values.devicePlugin.runtimeClassName -}}
-apiVersion: node.k8s.io/v1
-kind: RuntimeClass
-metadata:
-  name: {{ .Values.devicePlugin.runtimeClassName }}
-  annotations:
-    helm.sh/hook: pre-install,pre-upgrade
-handler: nvidia
-{{- end -}}
diff --git a/packages/system/hami/charts/hami/templates/scheduler/certmanager.yaml b/packages/system/hami/charts/hami/templates/scheduler/certmanager.yaml
deleted file mode 100644
index e6d28721..00000000
--- a/packages/system/hami/charts/hami/templates/scheduler/certmanager.yaml
+++ /dev/null
@@ -1,31 +0,0 @@
-{{- if .Values.scheduler.admissionWebhook.enabled -}}
-{{- if .Values.scheduler.certManager.enabled }}
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: {{ include "hami-vgpu.scheduler" . }}-serving-cert
-  namespace: {{ include "hami-vgpu.namespace" . }}
-  labels:
-    app.kubernetes.io/component: hami-scheduler
-    {{- include "hami-vgpu.labels" . | nindent 4 }}
-spec:
-  dnsNames:
-    - {{ include "hami-vgpu.scheduler" . }}.{{ include "hami-vgpu.namespace" . }}.svc
-    - {{ include "hami-vgpu.scheduler" . }}.{{ include "hami-vgpu.namespace" . }}.svc.cluster.local
-  issuerRef:
-    kind: Issuer
-    name: {{ include "hami-vgpu.scheduler" . }}-selfsigned-issuer
-  secretName: {{ include "hami-vgpu.scheduler.tls" . }}
----
-apiVersion: cert-manager.io/v1
-kind: Issuer
-metadata:
-  name: {{ include "hami-vgpu.scheduler" . }}-selfsigned-issuer
-  namespace: {{ include "hami-vgpu.namespace" . }}
-  labels:
-    app.kubernetes.io/component: hami-scheduler
-    {{- include "hami-vgpu.labels" . | nindent 4 }}
-spec:
-  selfSigned: {}
-{{- end }}
-{{- end }}
diff --git a/packages/system/hami/charts/hami/templates/scheduler/clusterrole.yaml b/packages/system/hami/charts/hami/templates/scheduler/clusterrole.yaml
deleted file mode 100644
index 81c4fddf..00000000
--- a/packages/system/hami/charts/hami/templates/scheduler/clusterrole.yaml
+++ /dev/null
@@ -1,34 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: {{ include "hami-vgpu.scheduler" . }}
-  labels:
-    app.kubernetes.io/component: "hami-scheduler"
-    {{- include "hami-vgpu.labels" . | nindent 4 }}
-rules:
-  - apiGroups: [""]
-    resources: ["pods", "configmaps"]
-    verbs: ["get", "list", "watch", "patch"]
-  - apiGroups: [""]
-    resources: ["pods/binding"]
-    verbs: ["create"]
-  - apiGroups: [""]
-    resources: ["nodes"]
-    verbs: ["get", "list", "patch", "watch"]
-  - apiGroups: [""]
-    resources: ["events"]
-    verbs: ["create", "get", "list"]
-  - apiGroups: [""]
-    resources: ["resourcequotas"]
-    verbs: ["get", "list", "watch"]
----
-{{- if .Values.mockDevicePlugin.enabled }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: {{ include "hami-vgpu.mock-device-plugin" . }}
-rules:
-  - apiGroups: [""]
-    resources: ["nodes"]
-    verbs: ["get", "update", "list", "patch"]
-{{- end -}}
diff --git a/packages/system/hami/charts/hami/templates/scheduler/clusterrolebinding.yaml b/packages/system/hami/charts/hami/templates/scheduler/clusterrolebinding.yaml
deleted file mode 100644
index a81d425c..00000000
--- a/packages/system/hami/charts/hami/templates/scheduler/clusterrolebinding.yaml
+++ /dev/null
@@ -1,47 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: {{ include "hami-vgpu.scheduler" . }}-kube
-  labels:
-    app.kubernetes.io/component: "hami-scheduler"
-    {{- include "hami-vgpu.labels" . | nindent 4 }}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: system:kube-scheduler
-subjects:
-  - kind: ServiceAccount
-    name: {{ include "hami-vgpu.scheduler" . }}
-    namespace: {{ include "hami-vgpu.namespace" . }}
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: {{ include "hami-vgpu.scheduler" . }}-volume
-  labels:
-    app.kubernetes.io/component: "hami-scheduler"
-    {{- include "hami-vgpu.labels" . | nindent 4 }}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: system:volume-scheduler
-subjects:
-  - kind: ServiceAccount
-    name: {{ include "hami-vgpu.scheduler" . }}
-    namespace: {{ include "hami-vgpu.namespace" . }}
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: {{ include "hami-vgpu.scheduler" . }}
-  labels:
-    app.kubernetes.io/component: "hami-scheduler"
-    {{- include "hami-vgpu.labels" . | nindent 4 }}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: {{ include "hami-vgpu.scheduler" . }}
-subjects:
-  - kind: ServiceAccount
-    name: {{ include "hami-vgpu.scheduler" . }}
-    namespace: {{ include "hami-vgpu.namespace" . }}
diff --git a/packages/system/hami/charts/hami/templates/scheduler/configmap.yaml b/packages/system/hami/charts/hami/templates/scheduler/configmap.yaml
deleted file mode 100644
index 109ecbce..00000000
--- a/packages/system/hami/charts/hami/templates/scheduler/configmap.yaml
+++ /dev/null
@@ -1,142 +0,0 @@
-{{- if .Values.scheduler.kubeScheduler.enabled -}}
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: {{ include "hami-vgpu.scheduler" . }}
-  namespace: {{ include "hami-vgpu.namespace" . }}
-  labels:
-    app.kubernetes.io/component: hami-scheduler
-    {{- include "hami-vgpu.labels" . | nindent 4 }}
-data:
-  config.json: |
-    {
-        "kind": "Policy",
-        "apiVersion": "v1",
-        "extenders": [
-            {
-                {{- if .Values.scheduler.admissionWebhook.enabled }}
-                "urlPrefix": "https://127.0.0.1:443",
-                "enableHttps": true,
-                "tlsConfig": {
-                    "insecure": true
-                },
-                {{- else }}
-                "urlPrefix": "http://127.0.0.1:80",
-                "enableHttps": false,
-                {{- end }}
-                "filterVerb": "filter",
-                "bindVerb": "bind",
-                "weight": 1,
-                "nodeCacheCapable": true,
-                "httpTimeout": 30000000000,
-                "managedResources": [
-                    {{- range .Values.devices.amd.customresources }}
-                    {
-                      "name": "{{ . }}",
-                      "ignoredByScheduler": true
-                    },
-                    {{- end }}
-                    {{- if .Values.devices.ascend.enabled }}
-                    {{- range .Values.devices.ascend.customresources }}
-                    {
-                      "name": "{{ . }}",
-                      "ignoredByScheduler": true
-                    },
-                    {{- end }}
-                    {{- end }}
-                    {{- if .Values.devices.mthreads.enabled }}
-                    {{- range .Values.devices.mthreads.customresources }}
-                    {
-                      "name": "{{ . }}",
-                      "ignoredByScheduler": true
-                    },
-                    {{- end }}
-                    {{- end }}
-                    {{- if .Values.devices.enflame.enabled }}
-                    {{- range .Values.devices.enflame.customresources }}
-                    {
-                      "name": "{{ . }}",
-                      "ignoredByScheduler": true
-                    },
-                    {{- end }}
-                    {{- end }}
-                    {{- if .Values.devices.kunlun.enabled }}
-                    {{- range .Values.devices.kunlun.customresources }}
-                    {
-                      "name": "{{ . }}",
-                      "ignoredByScheduler": true
-                    },
-                    {{- end }}
-                    {{- end }}
-                    {{- range .Values.devices.awsneuron.customresources }}
-                    {
-                      "name": "{{ . }}",
-                      "ignoredByScheduler": true
-                    },
-                    {{- end }}
-                    {{- if .Values.devices.iluvatar.enabled }}
-                    {{- range .Values.devices.iluvatar.customresources }}
-                    {
-                      "name": "{{ . }}",
-                      "ignoredByScheduler": true
-                    },
-                    {{- end }}
-                    {{- end }}
-                    {
-                        "name": "{{ .Values.resourceName }}",
-                        "ignoredByScheduler": true
-                    },
-                    {
-                        "name": "{{ .Values.resourceMem }}",
-                        "ignoredByScheduler": true
-                    },
-                    {
-                        "name": "{{ .Values.resourceCores }}",
-                        "ignoredByScheduler": true
-                    },
-                    {
-                        "name": "{{ .Values.resourceMemPercentage }}",
-                        "ignoredByScheduler": true
-                    },
-                    {
-                        "name": "{{ .Values.resourcePriority }}",
-                        "ignoredByScheduler": true
-                    },
-                    {
-                        "name": "{{ .Values.mluResourceName }}",
-                        "ignoredByScheduler": true
-                    },
-                    {
-                        "name": "{{ .Values.dcuResourceName }}",
-                        "ignoredByScheduler": true
-                    },
-                    {
-                        "name": "{{ .Values.dcuResourceMem }}",
-                        "ignoredByScheduler": true 
-                    },
-                    {
-                        "name": "{{ .Values.dcuResourceCores }}",
-                        "ignoredByScheduler": true
-                    },
-                    {
-                        "name": "metax-tech.com/gpu",
-                        "ignoredByScheduler": true
-                    },
-                    {
-                        "name": "{{ .Values.metaxResourceName }}",
-                        "ignoredByScheduler": true
-                    },
-                    {
-                        "name": "{{ .Values.metaxResourceCore }}",
-                        "ignoredByScheduler": true
-                    },
-                    {
-                        "name": "{{ .Values.metaxResourceMem }}",
-                        "ignoredByScheduler": true
-                    }
-                ],
-                "ignoreable": false
-            }
-        ]
-    }
-{{- end }}
diff --git a/packages/system/hami/charts/hami/templates/scheduler/configmapnew.yaml b/packages/system/hami/charts/hami/templates/scheduler/configmapnew.yaml
deleted file mode 100644
index 6f6db097..00000000
--- a/packages/system/hami/charts/hami/templates/scheduler/configmapnew.yaml
+++ /dev/null
@@ -1,102 +0,0 @@
-{{- if .Values.scheduler.kubeScheduler.enabled -}}
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: {{ include "hami-vgpu.scheduler" . }}-newversion
-  namespace: {{ include "hami-vgpu.namespace" . }}
-  labels:
-    app.kubernetes.io/component: hami-scheduler
-    {{- include "hami-vgpu.labels" . | nindent 4 }}
-data:
-  config.yaml: |
-    {{- if gt (regexReplaceAll "[^0-9]" .Capabilities.KubeVersion.Minor "" | int) 25}}
-    apiVersion: kubescheduler.config.k8s.io/v1
-    {{- else }}
-    apiVersion: kubescheduler.config.k8s.io/v1beta2
-    {{- end }}
-    kind: KubeSchedulerConfiguration
-    leaderElection:
-      leaderElect: false
-    profiles:
-    - schedulerName: {{ .Values.schedulerName }}
-    extenders:
-    {{- if .Values.scheduler.admissionWebhook.enabled }}
-    - urlPrefix: "https://127.0.0.1:443"
-      enableHTTPS: true
-      tlsConfig:
-        insecure: true
-    {{- else }}
-    - urlPrefix: "http://127.0.0.1:80"
-      enableHTTPS: false
-    {{- end }}
-      filterVerb: filter
-      bindVerb: bind
-      nodeCacheCapable: true
-      weight: 1
-      httpTimeout: 30s
-      managedResources:
-      - name: {{ .Values.resourceName }}
-        ignoredByScheduler: true
-      - name: {{ .Values.resourceMem }}
-        ignoredByScheduler: true
-      - name: {{ .Values.resourceCores }}
-        ignoredByScheduler: true
-      - name: {{ .Values.resourceMemPercentage }}
-        ignoredByScheduler: true
-      - name: {{ .Values.resourcePriority }}
-        ignoredByScheduler: true
-      - name: {{ .Values.mluResourceName }}
-        ignoredByScheduler: true
-      - name: {{ .Values.dcuResourceName }}
-        ignoredByScheduler: true
-      - name: {{ .Values.dcuResourceMem }}
-        ignoredByScheduler: true
-      - name: {{ .Values.dcuResourceCores }}
-        ignoredByScheduler: true
-      - name: "metax-tech.com/gpu"
-        ignoredByScheduler: true
-      - name: {{ .Values.metaxResourceName }}
-        ignoredByScheduler: true
-      - name: {{ .Values.metaxResourceCore }}
-        ignoredByScheduler: true
-      - name: {{ .Values.metaxResourceMem }}
-        ignoredByScheduler: true
-      {{- if .Values.devices.ascend.enabled }}
-      {{- range .Values.devices.ascend.customresources }}
-      - name: {{ . }}
-        ignoredByScheduler: true
-      {{- end }}
-      {{- end }}
-      {{- if .Values.devices.mthreads.enabled }}
-      {{- range .Values.devices.mthreads.customresources }}
-      - name: {{ . }}
-        ignoredByScheduler: true
-      {{- end }}
-      {{- end }}
-      {{- if .Values.devices.enflame.enabled }}
-      {{- range .Values.devices.enflame.customresources }}
-      - name: {{ . }}
-        ignoredByScheduler: true
-      {{- end }}
-      {{- end }}
-      {{- if .Values.devices.kunlun.enabled }}
-      {{- range .Values.devices.kunlun.customresources }}
-      - name: {{ . }}
-        ignoredByScheduler: true
-      {{- end }}
-      {{- end }}
-      {{- range .Values.devices.awsneuron.customresources }}
-      - name: {{ . }}
-        ignoredByScheduler: true
-      {{- end }}
-      {{- if .Values.devices.iluvatar.enabled }}
-      {{- range .Values.devices.iluvatar.customresources }}
-      - name: {{ . }}
-        ignoredByScheduler: true
-      {{- end }}
-      {{- end }}
-      {{- range .Values.devices.amd.customresources }}
-      - name: {{ . }}
-        ignoredByScheduler: true
-      {{- end }}
-{{- end }}
diff --git a/packages/system/hami/charts/hami/templates/scheduler/deployment.yaml b/packages/system/hami/charts/hami/templates/scheduler/deployment.yaml
deleted file mode 100644
index 1d89e189..00000000
--- a/packages/system/hami/charts/hami/templates/scheduler/deployment.yaml
+++ /dev/null
@@ -1,225 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: {{ include "hami-vgpu.scheduler" . }}
-  namespace: {{ include "hami-vgpu.namespace" . }}
-  labels:
-    app.kubernetes.io/component: hami-scheduler
-    {{- include "hami-vgpu.labels" . | nindent 4 }}
-    {{- with .Values.global.labels }}
-    {{- toYaml . | nindent 4 }}
-    {{- end }}
-  {{- if .Values.global.annotations }}
-  annotations: {{ toYaml .Values.global.annotations | nindent 4}}
-  {{- end }}
-spec:
-  {{- if .Values.scheduler.leaderElect }}
-  replicas: {{ .Values.scheduler.replicas }}
-  {{- else }}
-  replicas: 1
-  {{- end }}
-  selector:
-    matchLabels:
-      app.kubernetes.io/component: hami-scheduler
-      {{- include "hami-vgpu.selectorLabels" . | nindent 6 }}
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/component: hami-scheduler
-        {{- include "hami-vgpu.selectorLabels" . | nindent 8 }}
-        hami.io/webhook: ignore
-      annotations:
-        {{- if ge (regexReplaceAll "[^0-9]" .Capabilities.KubeVersion.Minor "" | int) 22 }}
-        checksum/hami-scheduler-newversion-config: {{ include (print $.Template.BasePath "/scheduler/configmapnew.yaml") . | sha256sum }}
-        {{- else }}
-        checksum/hami-scheduler-config: {{ include (print $.Template.BasePath "/scheduler/configmap.yaml") . | sha256sum }}
-        {{- end }}
-        checksum/hami-scheduler-device-config: {{ include (print $.Template.BasePath "/scheduler/device-configmap.yaml") . | sha256sum }}
-      {{- if .Values.scheduler.podAnnotations }}
-        {{- toYaml .Values.scheduler.podAnnotations | nindent 8 }}
-      {{- end }}
-    spec:
-      serviceAccountName: {{ include "hami-vgpu.scheduler" . }}
-      priorityClassName: system-node-critical
-      {{- include "hami.scheduler.extender.imagePullSecrets" . | nindent 6 }}
-      containers:
-        {{- if .Values.scheduler.kubeScheduler.enabled }}
-        - name: kube-scheduler
-          image: {{ include "hami.scheduler.kubeScheduler.image" . }}
-          imagePullPolicy: {{ .Values.scheduler.kubeScheduler.image.pullPolicy }}
-          command:
-            - kube-scheduler
-            {{- if ge (regexReplaceAll "[^0-9]" .Capabilities.KubeVersion.Minor "" | int) 22 }}
-            {{- range .Values.scheduler.kubeScheduler.extraNewArgs }}
-            - {{ . }}
-            {{- end }}
-            {{- else }}
-            - --scheduler-name={{ .Values.schedulerName }}
-            {{- range .Values.scheduler.kubeScheduler.extraArgs }}
-            - {{ . }}
-            {{- end }}
-            {{- end }}
-            - --leader-elect={{ .Values.scheduler.leaderElect }}
-            - --leader-elect-resource-name={{ .Values.schedulerName }}
-            - --leader-elect-resource-namespace={{ include "hami-vgpu.namespace" . }}
-          resources:
-          {{- toYaml .Values.scheduler.kubeScheduler.resources | nindent 12 }}
-          volumeMounts:
-            - name: scheduler-config
-              mountPath: /config
-        {{- end }}
-          {{- if .Values.scheduler.livenessProbe }}
-          livenessProbe:
-            failureThreshold: 8
-            httpGet:
-              path: /healthz
-              port: 10259
-              scheme: HTTPS
-            initialDelaySeconds: 10
-            periodSeconds: 10
-            successThreshold: 1
-            timeoutSeconds: 15
-          {{- end }}
-        - name: vgpu-scheduler-extender
-          image: {{ include "hami.scheduler.extender.image" . }}
-          imagePullPolicy: {{ .Values.scheduler.extender.image.pullPolicy }}
-          env:
-          {{- if .Values.scheduler.nodeLockExpire }}
-            - name: HAMI_NODELOCK_EXPIRE
-              value: "{{ .Values.scheduler.nodeLockExpire }}"
-          {{- end }}
-          {{- if .Values.global.managedNodeSelectorEnable }}
-          {{- range $key, $value := .Values.global.managedNodeSelector }}
-            - name: NODE_SELECTOR_{{ $key | upper | replace "-" "_" }}
-              value: "{{ $value }}"
-          {{- end }}
-          {{- end }}
-          command:
-            - scheduler
-            {{- if .Values.scheduler.admissionWebhook.enabled }}
-            - --http_bind=0.0.0.0:443
-            - --cert_file=/tls/tls.crt
-            - --key_file=/tls/tls.key
-            {{- else }}
-            - --http_bind=0.0.0.0:80
-            {{- end }}
-            - --scheduler-name={{ .Values.schedulerName }}
-            - --metrics-bind-address={{ .Values.scheduler.metricsBindAddress }}
-            - --node-scheduler-policy={{ .Values.scheduler.defaultSchedulerPolicy.nodeSchedulerPolicy }}
-            - --gpu-scheduler-policy={{ .Values.scheduler.defaultSchedulerPolicy.gpuSchedulerPolicy }}
-            - --force-overwrite-default-scheduler={{ .Values.scheduler.forceOverwriteDefaultScheduler}}
-            - --device-config-file=/device-config.yaml
-            - --leader-elect={{ .Values.scheduler.leaderElect }}
-            - --leader-elect-resource-name={{ .Values.schedulerName }}
-            - --leader-elect-resource-namespace={{ include "hami-vgpu.namespace" . }}
-            {{- if .Values.devices.ascend.enabled }}
-            - --enable-ascend=true
-            {{- end }}
-            {{- if .Values.devices.iluvatar.enabled }}
-            - --enable-iluvatar=true
-            {{- end }}
-            {{- if .Values.scheduler.nodeLabelSelector }}
-            - --node-label-selector={{- $first := true -}}
-              {{- range $key, $value := .Values.scheduler.nodeLabelSelector -}}
-              {{- if not $first }},{{ end -}}
-              {{- $key }}={{ $value -}}
-              {{- $first = false -}}
-              {{- end -}}
-            {{- end }}
-            {{- range .Values.scheduler.extender.extraArgs }}
-            - {{ . }}
-            {{- end }}
-          ports:
-            {{- if .Values.scheduler.admissionWebhook.enabled }}
-            - name: https
-              containerPort: 443
-              protocol: TCP
-            {{- else }}
-            - name: http
-              containerPort: 80
-              protocol: TCP
-            {{- end }}
-            - name: metrics
-              containerPort: {{ last (splitList ":" .Values.scheduler.metricsBindAddress) | int }}
-              protocol: TCP
-          resources:
-          {{- toYaml .Values.scheduler.extender.resources | nindent 12 }}
-          volumeMounts:
-            - name: device-config
-              mountPath: /device-config.yaml
-              subPath: device-config.yaml
-          {{- if .Values.scheduler.admissionWebhook.enabled }}
-            - name: tls-config
-              mountPath: /tls
-          {{- end }}
-          {{- if .Values.scheduler.livenessProbe }}
-          livenessProbe:
-            httpGet:
-              path: /healthz
-              {{- if .Values.scheduler.admissionWebhook.enabled }}
-              port: https
-              scheme: HTTPS
-              {{- else }}
-              port: http
-              scheme: HTTP
-              {{- end }}
-            initialDelaySeconds: 10
-            periodSeconds: 10
-            failureThreshold: 3
-            timeoutSeconds: 5
-          {{- end }}
-          {{- if .Values.scheduler.leaderElect }}
-          readinessProbe:
-            httpGet:
-              path: /readyz
-              {{- if .Values.scheduler.admissionWebhook.enabled }}
-              port: https
-              scheme: HTTPS
-              {{- else }}
-              port: http
-              scheme: HTTP
-              {{- end }}
-            initialDelaySeconds: 10
-            periodSeconds: 10
-            failureThreshold: 3
-            timeoutSeconds: 5
-          {{- end }}
-      {{- if .Values.scheduler.leaderElect }}
-      affinity:
-        podAntiAffinity:
-          requiredDuringSchedulingIgnoredDuringExecution:
-          - labelSelector:
-              matchExpressions:
-              - key: app.kubernetes.io/component
-                operator: In
-                values:
-                - hami-scheduler
-            topologyKey: "kubernetes.io/hostname"
-      {{- end }}
-      volumes:
-        {{- if .Values.scheduler.admissionWebhook.enabled }}
-        - name: tls-config
-          secret:
-            secretName: {{ template "hami-vgpu.scheduler.tls" . }}
-        {{- end }}
-        {{- if .Values.scheduler.kubeScheduler.enabled }}
-        - name: scheduler-config
-          configMap:
-            {{- if ge (regexReplaceAll "[^0-9]" .Capabilities.KubeVersion.Minor "" | int) 22 }}
-            name: {{ template "hami-vgpu.scheduler" . }}-newversion
-            {{- else }}
-            name: {{ template "hami-vgpu.scheduler" . }}
-            {{- end }}
-        {{- end }}
-        - name: device-config
-          configMap:
-            name: {{ include "hami-vgpu.scheduler" . }}-device
-      {{- if .Values.scheduler.nodeSelector }}
-      nodeSelector: {{ toYaml .Values.scheduler.nodeSelector | nindent 8 }}
-      {{- end }}
-      {{- if .Values.scheduler.tolerations }}
-      tolerations: {{ toYaml .Values.scheduler.tolerations | nindent 8 }}
-      {{- end }}
-      {{- if .Values.scheduler.nodeName }}
-      nodeName: {{ .Values.scheduler.nodeName }}
-      {{- end }}
diff --git a/packages/system/hami/charts/hami/templates/scheduler/device-configmap.yaml b/packages/system/hami/charts/hami/templates/scheduler/device-configmap.yaml
deleted file mode 100644
index 873b813b..00000000
--- a/packages/system/hami/charts/hami/templates/scheduler/device-configmap.yaml
+++ /dev/null
@@ -1,408 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: {{ include "hami-vgpu.scheduler" . }}-device
-  namespace: {{ include "hami-vgpu.namespace" . }}
-  labels:
-    app.kubernetes.io/component: hami-scheduler
-    {{- include "hami-vgpu.labels" . | nindent 4 }}
-data:
-  device-config.yaml: |-
-  {{- if .Files.Glob "files/device-config.yaml" }}
-  {{- .Files.Get "files/device-config.yaml" | nindent 4}}
-  {{- else }}
-    nvidia:
-      resourceCountName: {{ .Values.resourceName }}
-      resourceMemoryName: {{ .Values.resourceMem }}
-      resourceMemoryPercentageName: {{ .Values.resourceMemPercentage }}
-      resourceCoreName: {{ .Values.resourceCores }}
-      resourcePriorityName: {{ .Values.resourcePriority }}
-      overwriteEnv: false
-      defaultMemory: 0
-      defaultCores: 0
-      defaultGPUNum: 1
-      memoryFactor: 1
-      deviceSplitCount: {{ .Values.devicePlugin.deviceSplitCount }}
-      deviceMemoryScaling: {{ .Values.devicePlugin.deviceMemoryScaling }}
-      deviceCoreScaling: {{ .Values.devicePlugin.deviceCoreScaling }}
-      gpuCorePolicy: {{ .Values.devices.nvidia.gpuCorePolicy }}
-      libCudaLogLevel: {{ .Values.devices.nvidia.libCudaLogLevel }}
-      runtimeClassName: "{{ .Values.devicePlugin.runtimeClassName }}"
-      knownMigGeometries:
-      - models: [ "A30" ]
-        allowedGeometries:
-          - 
-            - name: 1g.6gb
-              core: 25
-              memory: 6144
-              count: 4
-          - 
-            - name: 2g.12gb
-              core: 50
-              memory: 12288
-              count: 2
-          - 
-            - name: 4g.24gb
-              core: 100
-              memory: 24576
-              count: 1
-      - models: [ "A100-SXM4-40GB", "A100-40GB-PCIe", "A100-PCIE-40GB"]
-        allowedGeometries:
-          - 
-            - name: 1g.5gb
-              core: 14
-              memory: 5120
-              count: 7
-          - 
-            - name: 1g.5gb
-              core: 14
-              memory: 5120
-              count: 1
-            - name: 2g.10gb
-              core: 28
-              memory: 10240
-              count: 3
-          - 
-            - name: 3g.20gb
-              core: 42
-              memory: 20480
-              count: 2
-          - 
-            - name: 7g.40gb
-              core: 100
-              memory: 40960
-              count: 1
-      - models: [ "A100-SXM4-80GB", "A100-80GB-PCIe", "A100-PCIE-80GB"]
-        allowedGeometries:
-          - 
-            - name: 1g.10gb
-              core: 14
-              memory: 10240
-              count: 7
-          - 
-            - name: 1g.10gb
-              core: 14
-              memory: 10240
-              count: 1
-            - name: 2g.20gb
-              core: 28
-              memory: 20480
-              count: 3
-          - 
-            - name: 3g.40gb
-              core: 42
-              memory: 40960
-              count: 2
-          - 
-            - name: 7g.79gb
-              core: 100
-              memory: 80896
-              count: 1
-      - models: [ "H100-PCIE-80GB", "H100-SXM5-80GB"]
-        allowedGeometries:
-          - 
-            - name: 1g.10gb
-              core: 14
-              memory: 10240
-              count: 7
-          - 
-            - name: 1g.10gb
-              core: 14
-              memory: 10240
-              count: 1
-            - name: 2g.20gb
-              core: 28
-              memory: 20480
-              count: 3
-          - 
-            - name: 3g.40gb
-              core: 42
-              memory: 40960
-              count: 2
-          - 
-            - name: 7g.80gb
-              core: 100
-              memory: 81920
-              count: 1
-      - models: [ "H100-PCIE-94GB", "H100-SXM5-94GB"]
-        allowedGeometries:
-          - 
-            - name: 1g.12gb
-              core: 14
-              memory: 12288
-              count: 7
-          - 
-            - name: 1g.12gb
-              core: 14
-              memory: 12288
-              count: 1
-            - name: 2g.24gb
-              core: 28
-              memory: 24576
-              count: 3
-          - 
-            - name: 3g.47gb
-              core: 42
-              memory: 48128
-              count: 2
-          - 
-            - name: 7g.94gb
-              core: 100
-              memory: 96256
-              count: 1
-      - models: [ "H20", "H100 on GH200"]
-        allowedGeometries:
-          - 
-            - name: 1g.12gb
-              core: 14
-              memory: 12288
-              count: 7
-          - 
-            - name: 1g.12gb
-              core: 14
-              memory: 12288
-              count: 1
-            - name: 2g.24gb
-              core: 28
-              memory: 24576
-              count: 3 
-          - 
-            - name: 3g.48gb
-              core: 42
-              memory: 49152
-              count: 2
-          - 
-            - name: 7g.96gb
-              core: 100
-              memory: 98304
-              count: 1
-      - models: [ "H200 NVL", "H200-SXM5"]
-        allowedGeometries:
-          - 
-            - name: 1g.18gb
-              core: 14
-              memory: 18432
-              count: 7
-          - 
-            - name: 1g.18gb
-              core: 14
-              memory: 18432
-              count: 1
-            - name: 2g.35gb
-              core: 28
-              memory: 35840
-              count: 3
-          - 
-            - name: 3g.71gb
-              core: 42
-              memory: 72704
-              count: 2
-          - 
-            - name: 7g.141gb
-              core: 100
-              memory: 144384
-              count: 1
-      - models: [ "B200" ]
-        allowedGeometries:
-          - 
-            - name: 1g.23gb
-              core: 14
-              memory: 23552
-              count: 7
-          - 
-            - name: 1g.23gb
-              core: 14
-              memory: 23552
-              count: 1
-            - name: 2g.45gb
-              core: 28
-              memory: 46080
-              count: 3
-          - 
-            - name: 3g.90gb
-              core: 42
-              memory: 92160
-              count: 2
-          - 
-            - name: 7g.180gb
-              core: 100
-              memory: 184320
-              count: 1
-    cambricon:
-      resourceCountName: {{ .Values.mluResourceName }}
-      resourceMemoryName: {{ .Values.mluResourceMem }}
-      resourceCoreName: {{ .Values.mluResourceCores }}
-    hygon:
-      resourceCountName: {{ .Values.dcuResourceName }}
-      resourceMemoryName: {{ .Values.dcuResourceMem }}
-      resourceCoreName: {{ .Values.dcuResourceCores }}
-      memoryFactor: 1
-    metax:
-      resourceCountName: "metax-tech.com/gpu"
-      resourceVCountName: {{ .Values.metaxResourceName }}
-      resourceVMemoryName: {{ .Values.metaxResourceMem }}
-      resourceVCoreName: {{ .Values.metaxResourceCore }}
-      sgpuTopologyAware: {{ .Values.metaxsGPUTopologyAware }}
-    enflame:
-      resourceNameGCU: "enflame.com/gcu"
-      resourceNameVGCU: {{ .Values.enflameResourceNameVGCU }}
-      resourceNameVGCUPercentage: {{ .Values.enflameResourceNameVGCUPercentage }}
-    mthreads:
-      resourceCountName: "mthreads.com/vgpu"
-      resourceMemoryName: "mthreads.com/sgpu-memory"
-      resourceCoreName: "mthreads.com/sgpu-core"
-    iluvatars:
-    - chipName: MR-V100
-      commonWord: MR-V100
-      resourceCountName: iluvatar.ai/MR-V100-vgpu
-      resourceMemoryName: iluvatar.ai/MR-V100.vMem
-      resourceCoreName: iluvatar.ai/MR-V100.vCore
-    - chipName: MR-V50
-      commonWord: MR-V50
-      resourceCountName: iluvatar.ai/MR-V50-vgpu
-      resourceMemoryName: iluvatar.ai/MR-V50.vMem
-      resourceCoreName: iluvatar.ai/MR-V50.vCore
-    - chipName: BI-V150
-      commonWord: BI-V150
-      resourceCountName: iluvatar.ai/BI-V150-vgpu
-      resourceMemoryName: iluvatar.ai/BI-V150.vMem
-      resourceCoreName: iluvatar.ai/BI-V150.vCore
-    - chipName: BI-V100
-      commonWord: BI-V100
-      resourceCountName: iluvatar.ai/BI-V100-vgpu
-      resourceMemoryName: iluvatar.ai/BI-V100.vMem
-      resourceCoreName: iluvatar.ai/BI-V100.vCore
-    kunlun:
-      resourceCountName: {{ .Values.kunlunResourceName }}
-      resourceVCountName: {{ .Values.kunlunResourceVCountName }}
-      resourceVMemoryName: {{ .Values.kunlunResourceVMemoryName }}
-    awsneuron:
-      resourceCountName: "aws.amazon.com/neuron"
-      resourceCoreName: "aws.amazon.com/neuroncore"
-    amd:
-      resourceCountName: "amd.com/gpu"
-    vnpus:
-    - chipName: 910A
-      commonWord: Ascend910A
-      resourceName: huawei.com/Ascend910A
-      resourceMemoryName: huawei.com/Ascend910A-memory
-      memoryAllocatable: 32768
-      memoryCapacity: 32768
-      memoryFactor: 1
-      aiCore: 30
-      templates:
-        - name: vir02
-          memory: 2184
-          aiCore: 2
-        - name: vir04
-          memory: 4369
-          aiCore: 4
-        - name: vir08
-          memory: 8738
-          aiCore: 8
-        - name: vir16
-          memory: 17476
-          aiCore: 16
-    - chipName: 910B2
-      commonWord: Ascend910B2
-      resourceName: huawei.com/Ascend910B2
-      resourceMemoryName: huawei.com/Ascend910B2-memory
-      memoryAllocatable: 65536
-      memoryCapacity: 65536
-      memoryFactor: 1
-      aiCore: 24
-      aiCPU: 6
-      templates:
-        - name: vir03_1c_8g
-          memory: 8192
-          aiCore: 3
-          aiCPU: 1
-        - name: vir06_1c_16g
-          memory: 16384
-          aiCore: 6
-          aiCPU: 1
-        - name: vir12_3c_32g
-          memory: 32768
-          aiCore: 12
-          aiCPU: 3
-    - chipName: 910B3
-      commonWord: Ascend910B3
-      resourceName: huawei.com/Ascend910B3
-      resourceMemoryName: huawei.com/Ascend910B3-memory
-      memoryAllocatable: 65536
-      memoryCapacity: 65536
-      memoryFactor: 1
-      aiCore: 20
-      aiCPU: 7
-      templates:
-        - name: vir05_1c_16g
-          memory: 16384
-          aiCore: 5
-          aiCPU: 1
-        - name: vir10_3c_32g
-          memory: 32768
-          aiCore: 10
-          aiCPU: 3
-    - chipName: 910B4-1
-      commonWord: Ascend910B4-1
-      resourceName: huawei.com/Ascend910B4-1
-      resourceMemoryName: huawei.com/Ascend910B4-1-memory
-      memoryAllocatable: 65536
-      memoryCapacity: 65536
-      memoryFactor: 1
-      aiCore: 20
-      aiCPU: 7
-      templates:
-        # NOTE: Names of vnpu template for 910B4-1 are fixed by Ascend runtime and must not be changed.
-        # The memory is used for scheduling so the correct values must be set.
-        # Template vir05_1c_8g actually provides 16GB memory,
-        - name: vir05_1c_8g
-          memory: 16384
-          aiCore: 5
-          aiCPU: 1
-        # Template vir10_3c_16g actually provides 32GB memory
-        - name: vir10_3c_16g
-          memory: 32768
-          aiCore: 10
-          aiCPU: 3
-    - chipName: 910B4
-      commonWord: Ascend910B4
-      resourceName: huawei.com/Ascend910B4
-      resourceMemoryName: huawei.com/Ascend910B4-memory
-      memoryAllocatable: 32768
-      memoryCapacity: 32768
-      memoryFactor: 1
-      aiCore: 20
-      aiCPU: 7
-      templates:
-        - name: vir05_1c_8g
-          memory: 8192
-          aiCore: 5
-          aiCPU: 1
-        - name: vir10_3c_16g
-          memory: 16384
-          aiCore: 10
-          aiCPU: 3
-    - chipName: 310P3
-      commonWord: Ascend310P
-      resourceName: huawei.com/Ascend310P
-      resourceMemoryName: huawei.com/Ascend310P-memory
-      memoryAllocatable: 21527
-      memoryCapacity: 24576
-      memoryFactor: 1
-      aiCore: 8
-      aiCPU: 7
-      templates:
-        - name: vir01
-          memory: 3072
-          aiCore: 1
-          aiCPU: 1
-        - name: vir02
-          memory: 6144
-          aiCore: 2
-          aiCPU: 2
-        - name: vir04
-          memory: 12288
-          aiCore: 4
-          aiCPU: 4
-  {{ end }}
diff --git a/packages/system/hami/charts/hami/templates/scheduler/job-patch/clusterrole.yaml b/packages/system/hami/charts/hami/templates/scheduler/job-patch/clusterrole.yaml
deleted file mode 100644
index 77e891cc..00000000
--- a/packages/system/hami/charts/hami/templates/scheduler/job-patch/clusterrole.yaml
+++ /dev/null
@@ -1,21 +0,0 @@
-{{- if and .Values.scheduler.admissionWebhook.enabled (.Values.scheduler.patch.enabled) (not .Values.scheduler.certManager.enabled) -}}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: {{ include "hami-vgpu.fullname" . }}-admission
-  annotations:
-    "helm.sh/hook": pre-install,pre-upgrade,post-install,post-upgrade
-    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
-  labels:
-    {{- include "hami-vgpu.labels" . | nindent 4 }}
-    app.kubernetes.io/component: admission-webhook
-rules:
-  - apiGroups:
-      - admissionregistration.k8s.io
-    resources:
-      #- validatingwebhookconfigurations
-      - mutatingwebhookconfigurations
-    verbs:
-      - get
-      - update
-{{- end }}
diff --git a/packages/system/hami/charts/hami/templates/scheduler/job-patch/clusterrolebinding.yaml b/packages/system/hami/charts/hami/templates/scheduler/job-patch/clusterrolebinding.yaml
deleted file mode 100644
index 2b82f926..00000000
--- a/packages/system/hami/charts/hami/templates/scheduler/job-patch/clusterrolebinding.yaml
+++ /dev/null
@@ -1,20 +0,0 @@
-{{- if and .Values.scheduler.admissionWebhook.enabled (.Values.scheduler.patch.enabled) (not .Values.scheduler.certManager.enabled) -}}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name:  {{ include "hami-vgpu.fullname" . }}-admission
-  annotations:
-    "helm.sh/hook": pre-install,pre-upgrade,post-install,post-upgrade
-    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
-  labels:
-    {{- include "hami-vgpu.labels" . | nindent 4 }}
-    app.kubernetes.io/component: admission-webhook
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: {{ include "hami-vgpu.fullname" . }}-admission
-subjects:
-  - kind: ServiceAccount
-    name: {{ include "hami-vgpu.fullname" . }}-admission
-    namespace: {{ include "hami-vgpu.namespace" . }}
-{{- end }}
diff --git a/packages/system/hami/charts/hami/templates/scheduler/job-patch/job-createSecret.yaml b/packages/system/hami/charts/hami/templates/scheduler/job-patch/job-createSecret.yaml
deleted file mode 100644
index 0e36d95f..00000000
--- a/packages/system/hami/charts/hami/templates/scheduler/job-patch/job-createSecret.yaml
+++ /dev/null
@@ -1,68 +0,0 @@
-{{- if and .Values.scheduler.admissionWebhook.enabled (.Values.scheduler.patch.enabled) (not .Values.scheduler.certManager.enabled) -}}
-apiVersion: batch/v1
-kind: Job
-metadata:
-  name: {{ include "hami-vgpu.fullname" . }}-admission-create
-  namespace: {{ include "hami-vgpu.namespace" . }}
-  annotations:
-    "helm.sh/hook": pre-install,pre-upgrade
-    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
-  labels:
-    {{- include "hami-vgpu.labels" . | nindent 4 }}
-    app.kubernetes.io/component: admission-webhook
-spec:
-  {{- if .Capabilities.APIVersions.Has "batch/v1alpha1" }}
-  # Alpha feature since k8s 1.12
-  ttlSecondsAfterFinished: 0
-  {{- end }}
-  template:
-    metadata:
-      name: {{ include "hami-vgpu.fullname" . }}-admission-create
-      {{- if .Values.scheduler.patch.podAnnotations }}
-      annotations: {{ toYaml .Values.scheduler.patch.podAnnotations | nindent 8 }}
-      {{- end }}
-      labels:
-        {{- include "hami-vgpu.labels" . | nindent 8 }}
-        app.kubernetes.io/component: admission-webhook
-        hami.io/webhook: ignore
-    spec:
-      {{- if .Values.scheduler.patch.priorityClassName }}
-      priorityClassName: {{ .Values.scheduler.patch.priorityClassName }}
-      {{- end }}
-      {{- if ge (regexReplaceAll "[^0-9]" .Capabilities.KubeVersion.Minor "" | int) 22 }}
-        {{- include "hami.scheduler.patch.new.imagePullSecrets" . | nindent 6 }}
-      {{- else }}
-        {{- include "hami.scheduler.patch.imagePullSecrets" . | nindent 6 }}
-      {{- end }}
-      containers:
-        - name: create
-          {{- if ge (regexReplaceAll "[^0-9]" .Capabilities.KubeVersion.Minor "" | int) 22 }}
-          image: {{ include "hami.scheduler.patch.new.image" . }}
-          imagePullPolicy: {{ .Values.scheduler.patch.imageNew.pullPolicy }}
-          {{- else }}
-          image: {{ include "hami.scheduler.patch.image" . }}
-          imagePullPolicy: {{ .Values.scheduler.patch.image.pullPolicy }}
-          {{- end }}
-          args:
-            - create
-            - --cert-name=tls.crt
-            - --key-name=tls.key
-            {{- if .Values.scheduler.admissionWebhook.customURL.enabled }}
-            - --host={{ printf "%s.%s.svc,127.0.0.1,%s" (include "hami-vgpu.scheduler" .) (include "hami-vgpu.namespace" .) .Values.scheduler.admissionWebhook.customURL.host}}
-            {{- else }}
-            - --host={{ printf "%s.%s.svc,127.0.0.1" (include "hami-vgpu.scheduler" .) (include "hami-vgpu.namespace" .) }}
-            {{- end }}
-            - --namespace={{ include "hami-vgpu.namespace" . }}
-            - --secret-name={{ include "hami-vgpu.scheduler.tls" . }}
-      restartPolicy: OnFailure
-      serviceAccountName: {{ include "hami-vgpu.fullname" . }}-admission
-      {{- if .Values.scheduler.patch.nodeSelector }}
-      nodeSelector: {{ toYaml .Values.scheduler.patch.nodeSelector | nindent 8 }}
-      {{- end }}
-      {{- if .Values.scheduler.patch.tolerations }}
-      tolerations: {{ toYaml .Values.scheduler.patch.tolerations | nindent 8 }}
-      {{- end }}
-      securityContext:
-        runAsNonRoot: true
-        runAsUser: {{ .Values.scheduler.patch.runAsUser }}
-{{- end }}
diff --git a/packages/system/hami/charts/hami/templates/scheduler/job-patch/job-patchWebhook.yaml b/packages/system/hami/charts/hami/templates/scheduler/job-patch/job-patchWebhook.yaml
deleted file mode 100644
index ce52042c..00000000
--- a/packages/system/hami/charts/hami/templates/scheduler/job-patch/job-patchWebhook.yaml
+++ /dev/null
@@ -1,63 +0,0 @@
-{{- if and .Values.scheduler.admissionWebhook.enabled (.Values.scheduler.patch.enabled) (not .Values.scheduler.certManager.enabled) -}}
-apiVersion: batch/v1
-kind: Job
-metadata:
-  name: {{ include "hami-vgpu.fullname" . }}-admission-patch
-  namespace: {{ include "hami-vgpu.namespace" . }}
-  annotations:
-    "helm.sh/hook": post-install,post-upgrade
-    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
-  labels:
-    {{- include "hami-vgpu.labels" . | nindent 4 }}
-    app.kubernetes.io/component: admission-webhook
-spec:
-  {{- if .Capabilities.APIVersions.Has "batch/v1alpha1" }}
-  # Alpha feature since k8s 1.12
-  ttlSecondsAfterFinished: 0
-  {{- end }}
-  template:
-    metadata:
-      name: {{ include "hami-vgpu.fullname" . }}-admission-patch
-      {{- if .Values.scheduler.patch.podAnnotations }}
-      annotations: {{ toYaml .Values.scheduler.patch.podAnnotations | nindent 8 }}
-      {{- end }}
-      labels:
-        {{- include "hami-vgpu.labels" . | nindent 8 }}
-        app.kubernetes.io/component: admission-webhook
-        hami.io/webhook: ignore
-    spec:
-      {{- if .Values.scheduler.patch.priorityClassName }}
-      priorityClassName: {{ .Values.scheduler.patch.priorityClassName }}
-      {{- end }}
-      {{- if ge (regexReplaceAll "[^0-9]" .Capabilities.KubeVersion.Minor "" | int) 22 }}
-        {{- include "hami.scheduler.patch.new.imagePullSecrets" . | nindent 6 }}
-      {{- else }}
-        {{- include "hami.scheduler.patch.imagePullSecrets" . | nindent 6 }}
-      {{- end }}
-      containers:
-        - name: patch
-          {{- if ge (regexReplaceAll "[^0-9]" .Capabilities.KubeVersion.Minor "" | int) 22 }}
-          image: {{ include "hami.scheduler.patch.new.image" . }}
-          imagePullPolicy: {{ .Values.scheduler.patch.imageNew.pullPolicy }}
-          {{- else }}
-          image: {{ include "hami.scheduler.patch.image" . }}
-          imagePullPolicy: {{ .Values.scheduler.patch.image.pullPolicy }}
-          {{- end }}
-          args:
-            - patch
-            - --webhook-name={{ include "hami-vgpu.scheduler.webhook" . }}
-            - --namespace={{ include "hami-vgpu.namespace" . }}
-            - --patch-validating=false
-            - --secret-name={{ include "hami-vgpu.scheduler.tls" . }}
-      restartPolicy: OnFailure
-      serviceAccountName: {{ include "hami-vgpu.fullname" . }}-admission
-      {{- if .Values.scheduler.patch.nodeSelector }}
-      nodeSelector: {{ toYaml .Values.scheduler.patch.nodeSelector | nindent 8 }}
-      {{- end }}
-      {{- if .Values.scheduler.patch.tolerations }}
-      tolerations: {{ toYaml .Values.scheduler.patch.tolerations | nindent 8 }}
-      {{- end }}
-      securityContext:
-        runAsNonRoot: true
-        runAsUser: {{ .Values.scheduler.patch.runAsUser }}
-{{- end }}
diff --git a/packages/system/hami/charts/hami/templates/scheduler/job-patch/role.yaml b/packages/system/hami/charts/hami/templates/scheduler/job-patch/role.yaml
deleted file mode 100644
index 56682f8e..00000000
--- a/packages/system/hami/charts/hami/templates/scheduler/job-patch/role.yaml
+++ /dev/null
@@ -1,21 +0,0 @@
-{{- if and .Values.scheduler.admissionWebhook.enabled (.Values.scheduler.patch.enabled) (not .Values.scheduler.certManager.enabled) -}}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name:  {{ include "hami-vgpu.fullname" . }}-admission
-  namespace: {{ include "hami-vgpu.namespace" . }}
-  annotations:
-    "helm.sh/hook": pre-install,pre-upgrade,post-install,post-upgrade
-    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
-  labels:
-    {{- include "hami-vgpu.labels" . | nindent 4 }}
-    app.kubernetes.io/component: admission-webhook
-rules:
-  - apiGroups:
-      - ""
-    resources:
-      - secrets
-    verbs:
-      - get
-      - create
-{{- end }}
diff --git a/packages/system/hami/charts/hami/templates/scheduler/job-patch/rolebinding.yaml b/packages/system/hami/charts/hami/templates/scheduler/job-patch/rolebinding.yaml
deleted file mode 100644
index 7239b128..00000000
--- a/packages/system/hami/charts/hami/templates/scheduler/job-patch/rolebinding.yaml
+++ /dev/null
@@ -1,21 +0,0 @@
-{{- if and .Values.scheduler.admissionWebhook.enabled (.Values.scheduler.patch.enabled) (not .Values.scheduler.certManager.enabled) -}}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: {{ include "hami-vgpu.fullname" . }}-admission
-  namespace: {{ include "hami-vgpu.namespace" . }}
-  annotations:
-    "helm.sh/hook": pre-install,pre-upgrade,post-install,post-upgrade
-    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
-  labels:
-    {{- include "hami-vgpu.labels" . | nindent 4 }}
-    app.kubernetes.io/component: admission-webhook
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: {{ include "hami-vgpu.fullname" . }}-admission
-subjects:
-  - kind: ServiceAccount
-    name: {{ include "hami-vgpu.fullname" . }}-admission
-    namespace: {{ include "hami-vgpu.namespace" . }}
-{{- end }}
diff --git a/packages/system/hami/charts/hami/templates/scheduler/job-patch/serviceaccount.yaml b/packages/system/hami/charts/hami/templates/scheduler/job-patch/serviceaccount.yaml
deleted file mode 100644
index 857c6a8d..00000000
--- a/packages/system/hami/charts/hami/templates/scheduler/job-patch/serviceaccount.yaml
+++ /dev/null
@@ -1,13 +0,0 @@
-{{- if and .Values.scheduler.admissionWebhook.enabled (.Values.scheduler.patch.enabled) (not .Values.scheduler.certManager.enabled) }}
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: {{ include "hami-vgpu.fullname" . }}-admission
-  namespace: {{ include "hami-vgpu.namespace" . }}
-  annotations:
-    "helm.sh/hook": pre-install,pre-upgrade,post-install,post-upgrade
-    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
-  labels:
-    {{- include "hami-vgpu.labels" . | nindent 4 }}
-    app.kubernetes.io/component: admission-webhook
-{{- end }}
diff --git a/packages/system/hami/charts/hami/templates/scheduler/role.yaml b/packages/system/hami/charts/hami/templates/scheduler/role.yaml
deleted file mode 100644
index 5f7d7e44..00000000
--- a/packages/system/hami/charts/hami/templates/scheduler/role.yaml
+++ /dev/null
@@ -1,12 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: {{ include "hami-vgpu.scheduler" . }}
-  namespace: {{ include "hami-vgpu.namespace" . }}
-  labels:
-    app.kubernetes.io/component: "hami-scheduler"
-    {{- include "hami-vgpu.labels" . | nindent 4 }}
-rules:
-  - apiGroups: ["coordination.k8s.io"]
-    resources: ["leases"]
-    verbs: ["create", "list", "watch", "get", "update", "patch"]
diff --git a/packages/system/hami/charts/hami/templates/scheduler/rolebinding.yaml b/packages/system/hami/charts/hami/templates/scheduler/rolebinding.yaml
deleted file mode 100644
index 96e175a1..00000000
--- a/packages/system/hami/charts/hami/templates/scheduler/rolebinding.yaml
+++ /dev/null
@@ -1,31 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: {{ include "hami-vgpu.scheduler" . }}
-  namespace: {{ include "hami-vgpu.namespace" . }}
-  labels:
-    app.kubernetes.io/component: "hami-scheduler"
-    {{- include "hami-vgpu.labels" . | nindent 4 }}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: {{ include "hami-vgpu.scheduler" . }}
-subjects:
-  - kind: ServiceAccount
-    name: {{ include "hami-vgpu.scheduler" . }}
-    namespace: {{ include "hami-vgpu.namespace" . }}
----
-{{- if .Values.mockDevicePlugin.enabled }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: {{ include "hami-vgpu.mock-device-plugin" . }}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: {{ include "hami-vgpu.mock-device-plugin" . }}
-subjects:
-  - kind: ServiceAccount
-    name: {{ include "hami-vgpu.mock-device-plugin" . }}
-    namespace: {{ include "hami-vgpu.namespace" . }}
-{{- end -}}
diff --git a/packages/system/hami/charts/hami/templates/scheduler/service.yaml b/packages/system/hami/charts/hami/templates/scheduler/service.yaml
deleted file mode 100644
index d7538fed..00000000
--- a/packages/system/hami/charts/hami/templates/scheduler/service.yaml
+++ /dev/null
@@ -1,34 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: {{ include "hami-vgpu.scheduler" . }}
-  namespace: {{ include "hami-vgpu.namespace" . }}
-  labels:
-    app.kubernetes.io/component: hami-scheduler
-    {{- include "hami-vgpu.labels" . | nindent 4 }}
-    {{- if .Values.scheduler.service.labels }}
-    {{ toYaml .Values.scheduler.service.labels | indent 4 }}
-    {{- end }}
-  {{- if .Values.scheduler.service.annotations }}
-  annotations: {{ toYaml .Values.scheduler.service.annotations | nindent 4 }}
-  {{- end }}
-spec:
-  type: {{ .Values.scheduler.service.type | default "NodePort" }}  # Default type is NodePort
-  ports:
-    - name: http
-      port: {{ .Values.scheduler.service.httpPort | default 443 }}  # Default HTTP port is 443
-      targetPort: {{ .Values.scheduler.service.httpTargetPort | default 443 }}
-      {{- if eq (.Values.scheduler.service.type | default "NodePort") "NodePort" }}  # If type is NodePort, set nodePort
-      nodePort: {{ .Values.scheduler.service.schedulerPort | default 31998 }}
-      {{- end }}
-      protocol: TCP
-    - name: monitor
-      port: {{ .Values.scheduler.service.monitorPort | default 31993 }}  # Default monitoring port is 31993
-      targetPort: {{ .Values.scheduler.service.monitorTargetPort | default 9395 }}
-      {{- if eq (.Values.scheduler.service.type | default "NodePort") "NodePort" }}  # If type is NodePort, set nodePort
-      nodePort: {{ .Values.scheduler.service.monitorPort | default 31993 }}
-      {{- end }}
-      protocol: TCP
-  selector:
-    app.kubernetes.io/component: hami-scheduler
-    {{- include "hami-vgpu.selectorLabels" . | nindent 4 }}
diff --git a/packages/system/hami/charts/hami/templates/scheduler/serviceaccount.yaml b/packages/system/hami/charts/hami/templates/scheduler/serviceaccount.yaml
deleted file mode 100644
index 0435c003..00000000
--- a/packages/system/hami/charts/hami/templates/scheduler/serviceaccount.yaml
+++ /dev/null
@@ -1,16 +0,0 @@
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: {{ include "hami-vgpu.scheduler" . }}
-  namespace: {{ include "hami-vgpu.namespace" . }}
-  labels:
-    app.kubernetes.io/component: "hami-scheduler"
-    {{- include "hami-vgpu.labels" . | nindent 4 }}
----
-{{- if .Values.mockDevicePlugin.enabled }}
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: {{ include "hami-vgpu.mock-device-plugin" . }}
-  namespace: {{ include "hami-vgpu.namespace" . }}
-{{- end -}}
diff --git a/packages/system/hami/charts/hami/templates/scheduler/webhook.yaml b/packages/system/hami/charts/hami/templates/scheduler/webhook.yaml
deleted file mode 100644
index db9f8029..00000000
--- a/packages/system/hami/charts/hami/templates/scheduler/webhook.yaml
+++ /dev/null
@@ -1,57 +0,0 @@
-{{- if .Values.scheduler.admissionWebhook.enabled -}}
-apiVersion: admissionregistration.k8s.io/v1
-kind: MutatingWebhookConfiguration
-metadata:
-  {{- if .Values.scheduler.certManager.enabled }}
-  annotations:
-    cert-manager.io/inject-ca-from: {{ include "hami-vgpu.namespace" . }}/{{ include "hami-vgpu.scheduler" . }}-serving-cert
-  {{- end }}
-  name: {{ include "hami-vgpu.scheduler.webhook" . }}
-webhooks:
-  - admissionReviewVersions:
-    - v1beta1
-    clientConfig:
-      {{- if .Values.scheduler.admissionWebhook.customURL.enabled }}
-      url: https://{{ .Values.scheduler.admissionWebhook.customURL.host}}:{{.Values.scheduler.admissionWebhook.customURL.port}}{{.Values.scheduler.admissionWebhook.customURL.path}}
-      {{- else }}
-      service:
-        name: {{ include "hami-vgpu.scheduler" . }}
-        namespace: {{ include "hami-vgpu.namespace" . }}
-        path: /webhook
-        port: {{ .Values.scheduler.service.httpPort }}
-      {{- end }}
-    failurePolicy: {{ .Values.scheduler.admissionWebhook.failurePolicy }}
-    matchPolicy: Equivalent
-    name: vgpu.hami.io
-    namespaceSelector:
-      matchExpressions:
-      - key: hami.io/webhook
-        operator: NotIn
-        values:
-        - ignore
-      {{- if .Values.scheduler.admissionWebhook.whitelistNamespaces }}
-      - key: kubernetes.io/metadata.name
-        operator: NotIn
-        values:
-        {{- toYaml .Values.scheduler.admissionWebhook.whitelistNamespaces | nindent 10 }}
-      {{- end }}
-    objectSelector:
-      matchExpressions:
-      - key: hami.io/webhook
-        operator: NotIn
-        values:
-        - ignore
-    reinvocationPolicy: {{ .Values.scheduler.admissionWebhook.reinvocationPolicy }}
-    rules:
-      - apiGroups:
-          - ""
-        apiVersions:
-          - v1
-        operations:
-          - CREATE
-        resources:
-          - pods
-        scope: '*'
-    sideEffects: None
-    timeoutSeconds: 10
-{{- end }}
diff --git a/packages/system/hami/charts/hami/values.yaml b/packages/system/hami/charts/hami/values.yaml
deleted file mode 100644
index 01caca0b..00000000
--- a/packages/system/hami/charts/hami/values.yaml
+++ /dev/null
@@ -1,455 +0,0 @@
-## @section Global configuration
-## @param global.imageRegistry Global Docker image registry
-## @param global.imagePullSecrets Global Docker image pull secrets
-global:
-  ## @param global.imageRegistry Global Docker image registry
-  imageRegistry: ""
-  ## E.g.
-  ## imagePullSecrets:
-  ##   - myRegistryKeySecretName
-  ## @param global.imagePullSecrets Global Docker image pull secrets
-  imagePullSecrets: []
-  imageTag: "v2.8.1"
-  gpuHookPath: /usr/local
-  labels: {}
-  annotations: {}
-  managedNodeSelectorEnable: false
-  managedNodeSelector:
-    usage: "gpu"
-
-nameOverride: ""
-fullnameOverride: ""
-namespaceOverride: ""
-
-#Nvidia GPU Parameters
-resourceName: "nvidia.com/gpu"
-resourceMem: "nvidia.com/gpumem"
-resourceMemPercentage: "nvidia.com/gpumem-percentage"
-resourceCores: "nvidia.com/gpucores"
-resourcePriority: "nvidia.com/priority"
-
-#MLU Parameters
-mluResourceName: "cambricon.com/vmlu"
-mluResourceMem: "cambricon.com/mlu.smlu.vmemory"
-mluResourceCores: "cambricon.com/mlu.smlu.vcore"
-
-#Hygon DCU Parameters
-dcuResourceName: "hygon.com/dcunum"
-dcuResourceMem: "hygon.com/dcumem"
-dcuResourceCores: "hygon.com/dcucores"
-
-#Metax sGPU Parameters
-metaxResourceName: "metax-tech.com/sgpu"
-metaxResourceCore: "metax-tech.com/vcore"
-metaxResourceMem: "metax-tech.com/vmemory"
-metaxsGPUTopologyAware: "false"
-
-#Enflame VGCU Parameters
-enflameResourceNameVGCU: "enflame.com/vgcu"
-enflameResourceNameVGCUPercentage: "enflame.com/vgcu-percentage"
-
-#Kunlun XPU Parameters
-kunlunResourceName: "kunlunxin.com/xpu"
-kunlunResourceVCountName: "kunlunxin.com/vxpu"
-kunlunResourceVMemoryName: "kunlunxin.com/vxpu-memory"
-
-schedulerName: "hami-scheduler"
-
-scheduler:
-  # @param nodeName defines the node name and the nvidia-vgpu-scheduler-scheduler will schedule to the node.
-  # if we install the nvidia-vgpu-scheduler-scheduler as default scheduler, we need to remove the k8s default
-  # scheduler pod from the cluster first, we must specify node name to skip the schedule workflow.
-  nodeName: ""
-  #nodeLabelSelector:
-  #  "gpu": "on"
-  overwriteEnv: "false"
-  defaultSchedulerPolicy:
-    nodeSchedulerPolicy: binpack
-    gpuSchedulerPolicy: spread
-  metricsBindAddress: ":9395"
-  # If set to false, When Pod.Spec.SchedulerName equals to the const DefaultSchedulerName in k8s.io/api/core/v1 package, webhook will not overwrite it
-  forceOverwriteDefaultScheduler: true
-  livenessProbe: false
-  leaderElect: true
-  # when leaderElect is true, replicas is available, otherwise replicas is 1.
-  replicas: 1
-  kubeScheduler:
-    # @param enabled indicate whether to run kube-scheduler container in the scheduler pod, it's true by default.
-    enabled: true
-    ## @param image.registry kube scheduler image registry
-    ## @param image.repository kube scheduler image repository
-    ## @param image.tag kube scheduler image tag (immutable tags are recommended)
-    ## @param image.pullPolicy kube scheduler image pull policy
-    ## @param image.pullSecrets Specify docker-registry secret names as an array
-    image:
-      registry: "registry.cn-hangzhou.aliyuncs.com"
-      repository: "google_containers/kube-scheduler"
-      tag: ""
-      ## Specify a imagePullPolicy
-      ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent'
-      ## ref: https://kubernetes.io/docs/user-guide/images/#pre-pulling-images
-      ##
-      pullPolicy: IfNotPresent
-      ## Optionally specify an array of imagePullSecrets.
-      ## Secrets must be manually created in the namespace.
-      ## Example:
-      ## pullSecrets:
-      ##   - myRegistryKeySecretName
-      ##
-      pullSecrets: []
-    resources: {}
-      # If you do want to specify resources, uncomment the following lines, adjust them as necessary.
-      # and remove the curly braces after 'resources:'.
-#      limits:
-#        cpu: 1000m
-#        memory: 1000Mi
-#      requests:
-#        cpu: 100m
-#        memory: 100Mi
-    extraNewArgs:
-      - --config=/config/config.yaml
-      - -v=4
-    extraArgs:
-      - --policy-config-file=/config/config.json
-      - -v=4
-  extender:
-    ## @param image.registry scheduler extender image registry
-    ## @param image.repository scheduler extender image repository
-    ## @param image.tag scheduler extender image tag (immutable tags are recommended)
-    ## @param image.pullPolicy scheduler extender image pull policy
-    ## @param image.pullSecrets Specify docker-registry secret names as an array
-    image:
-      registry: "docker.io"
-      repository: "projecthami/hami"
-      tag: ""
-      ## Specify a imagePullPolicy
-      ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent'
-      ## ref: https://kubernetes.io/docs/user-guide/images/#pre-pulling-images
-      ##
-      pullPolicy: IfNotPresent
-      ## Optionally specify an array of imagePullSecrets.
-      ## Secrets must be manually created in the namespace.
-      ## Example:
-      ## pullSecrets:
-      ##   - myRegistryKeySecretName
-      ##
-      pullSecrets: []
-    resources: {}
-      # If you do want to specify resources, uncomment the following lines, adjust them as necessary,
-      # and remove the curly braces after 'resources:'.
-#      limits:
-#        cpu: 1000m
-#        memory: 1000Mi
-#      requests:
-#        cpu: 100m
-#        memory: 100Mi
-    extraArgs:
-      - --debug
-      - -v=4
-  nodeLockExpire: "5m"
-  podAnnotations: {}
-  tolerations: []
-  #serviceAccountName: "hami-vgpu-scheduler-sa"
-  admissionWebhook:
-    # If set to false, the admission webhook is not installed and any pods that should use HAMi must be
-    # configured to use the right 'schedulerName' and other device-specific configurations.
-    enabled: true
-    customURL:
-      enabled: false
-      # must be an endpoint using https.
-      # should generate host certs here
-      host: 127.0.0.1 # hostname or ip, can be your node'IP if you want to use https://<nodeIP>:<schedulerPort>/<path>
-      port: 31998
-      path: /webhook
-    whitelistNamespaces:
-    # Specify the namespaces that the webhook will not be applied to.
-      # - default
-      # - kube-system
-      # - istio-system
-    reinvocationPolicy: Never
-    failurePolicy: Ignore
-  ## TLS Certificate Option 1: Use cert-manager to generate self-signed certificate.
-  ## If enabled, always takes precedence over options 2.
-  certManager:
-    enabled: false
-  ## TLS Certificate Option 2: Use kube-webhook-certgen to generate self-signed certificate.
-  ## If true and certManager.enabled is false, Helm will automatically create a self-signed cert and secret for you.
-  patch:
-    enabled: true
-    ## @param image.registry scheduler extender image registry
-    ## @param image.repository scheduler extender image repository
-    ## @param image.tag scheduler extender image tag (immutable tags are recommended)
-    ## @param image.pullPolicy scheduler extender image pull policy
-    ## @param image.pullSecrets Specify docker-registry secret names as an array
-    image:
-      registry: "docker.io"
-      repository: "jettech/kube-webhook-certgen"
-      tag: "v1.5.2"
-      ## Specify a imagePullPolicy
-      ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent'
-      ## ref: https://kubernetes.io/docs/user-guide/images/#pre-pulling-images
-      ##
-      pullPolicy: IfNotPresent
-      ## Optionally specify an array of imagePullSecrets.
-      ## Secrets must be manually created in the namespace.
-      ## Example:
-      ## pullSecrets:
-      ##   - myRegistryKeySecretName
-      ##
-      pullSecrets: []
-    ## @param image.registry scheduler extender image registry
-    ## @param image.repository scheduler extender image repository
-    ## @param image.tag scheduler extender image tag (immutable tags are recommended)
-    ## @param image.pullPolicy scheduler extender image pull policy
-    ## @param image.pullSecrets Specify docker-registry secret names as an array
-    imageNew: 
-      registry: "docker.io"
-      repository: "liangjw/kube-webhook-certgen"
-      tag: "v1.1.1"
-      ## Specify a imagePullPolicy
-      ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent'
-      ## ref: https://kubernetes.io/docs/user-guide/images/#pre-pulling-images
-      ##
-      pullPolicy: IfNotPresent
-      ## Optionally specify an array of imagePullSecrets.
-      ## Secrets must be manually created in the namespace.
-      ## Example:
-      ## pullSecrets:
-      ##   - myRegistryKeySecretName
-      ##
-      pullSecrets: []
-    priorityClassName: ""
-    podAnnotations: {}
-    nodeSelector: {}
-    tolerations: []
-    runAsUser: 2000
-  service:
-    type: NodePort  # Default type is NodePort, can be changed to ClusterIP
-    httpPort: 443   # HTTP port
-    schedulerPort: 31998  # NodePort for HTTP
-    monitorPort: 31993    # Monitoring port
-    monitorTargetPort: 9395
-    httpTargetPort: 443
-    labels: {}
-    annotations: {}
-
-devicePlugin:
-  enabled: true
-  gpuOperatorToolkitReady:
-    enabled: false
-    hostPath: "/run/nvidia/validations"
-  ## @param image.registry devicePlugin image registry
-  ## @param image.repository devicePlugin image repository
-  ## @param image.tag devicePlugin image tag (immutable tags are recommended)
-  ## @param image.pullPolicy devicePlugin image pull policy
-  ## @param image.pullSecrets Specify docker-registry secret names as an array
-  image:
-    registry: "docker.io"
-    repository: "projecthami/hami"
-    tag: ""
-    ## Specify a imagePullPolicy
-    ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent'
-    ## ref: https://kubernetes.io/docs/user-guide/images/#pre-pulling-images
-    ##
-    pullPolicy: IfNotPresent
-    ## Optionally specify an array of imagePullSecrets.
-    ## Secrets must be manually created in the namespace.
-    ## Example:
-    ## pullSecrets:
-    ##   - myRegistryKeySecretName
-    ##
-    pullSecrets: []
-  monitor:
-    ## @param image.registry monitor image registry
-    ## @param image.repository monitor image repository
-    ## @param image.tag monitor image tag (immutable tags are recommended)
-    ## @param image.pullPolicy monitor image pull policy
-    ## @param image.pullSecrets Specify docker-registry secret names as an array
-    image:
-      registry: "docker.io"
-      repository: "projecthami/hami"
-      tag: ""
-      ## Specify a imagePullPolicy
-      ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent'
-      ## ref: https://kubernetes.io/docs/user-guide/images/#pre-pulling-images
-      ##
-      pullPolicy: IfNotPresent
-      ## Optionally specify an array of imagePullSecrets.
-      ## Secrets must be manually created in the namespace.
-      ## Example:
-      ## pullSecrets:
-      ##   - myRegistryKeySecretName
-      ##
-      pullSecrets: []
-    ctrPath: /usr/local/vgpu/containers
-    resyncInterval: "5m"
-    extraArgs:
-      - -v=4
-    extraEnvs: {}
-    resources: {}
-      # If you do want to specify resources, uncomment the following lines, adjust them as necessary.
-      # and remove the curly braces after 'resources:'.
-#      limits:
-#        cpu: 1000m
-#        memory: 1000Mi
-#      requests:
-#        cpu: 100m
-#        memory: 100Mi
-
-  deviceSplitCount: 10
-  deviceMemoryScaling: 1
-  deviceCoreScaling: 1
-  # Node configuration for device plugin, Priority: externalConfigName > config > default config
-  nodeConfiguration:
-    # If you want to use a custom config.json, you can set the content here.
-    # If this is set, it will override the default config.json(An example is as follows).
-    config: |
-      {
-        "nodeconfig": [
-          {
-            "name": "your-node-name",
-            "operatingmode": "hami-core",
-            "devicememoryscaling": 1,
-            "devicesplitcount": 10,
-            "migstrategy": "none",
-            "filterdevices": {
-              "uuid": [],
-              "index": []
-            }
-          }
-        ]
-      }
-    # If you want to use an existing ConfigMap, you can set the name here.
-    # If this is set, the chart will not create the ConfigMap and will use the existing one.
-    externalConfigName: ""
-  # The runtime class name to be used by the device plugin, and added to the pod.spec.runtimeClassName of applications utilizing NVIDIA GPUs
-  runtimeClassName: ""
-  # Whether to create runtime class, name comes from runtimeClassName when it is set
-  createRuntimeClass: false
-  migStrategy: "none"
-  disablecorelimit: "false"
-  passDeviceSpecsEnabled: false
-  deviceListStrategy: "envvar"
-  nvidiaHookPath: null
-  nvidiaDriverRoot: null
-  gdrcopyEnabled: null
-  gdsEnabled: null
-  mofedEnabled: null
-
-  extraArgs:
-    - -v=4
-  extraEnvs: {}
-  service:
-    type: NodePort  # Default type is NodePort, can be changed to ClusterIP
-    httpPort: 31992
-    labels: {}
-    annotations: {}
-
-  pluginPath: /var/lib/kubelet/device-plugins
-  libPath: /usr/local/vgpu
-
-  podAnnotations: {}
-  nvidiaNodeSelector:
-    gpu: "on"
-  tolerations: []
-  # The updateStrategy for DevicePlugin DaemonSet.
-  # If you want to update the DaemonSet by manual, set type as "OnDelete".
-  # We recommend use OnDelete update strategy because DevicePlugin pod restart will cause business pod restart, this behavior is destructive.
-  # Otherwise, you can use RollingUpdate update strategy to rolling update DevicePlugin pod.
-  updateStrategy:
-    type: RollingUpdate
-    rollingUpdate:
-      maxUnavailable: 1
-
-  resources: {}
-    # If you do want to specify resources, uncomment the following lines, adjust them as necessary.
-    # and remove the curly braces after 'resources:'.
-#    limits:
-#       cpu: 1000m
-#       memory: 1000Mi
-#    requests:
-#      cpu: 100m
-#      memory: 100Mi
-
-mockDevicePlugin:
-  enabled: false
-  image:
-    registry: "docker.io"
-    repository: "projecthami/mock-device-plugin"
-    tag: "1.0.1"
-    ## Specify a imagePullPolicy
-    ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent'
-    ## ref: https://kubernetes.io/docs/user-guide/images/#pre-pulling-images
-    ##
-    pullPolicy: IfNotPresent
-    ## Optionally specify an array of imagePullSecrets.
-    ## Secrets must be manually created in the namespace.
-    ## Example:
-    ## pullSecrets:
-    ##   - myRegistryKeySecretName
-    ##
-    pullSecrets: []
-devices:
-  amd:
-    customresources:
-      - amd.com/gpu
-      - amd.com/gpu-memory
-  awsneuron:
-    customresources:
-      - aws.amazon.com/neuron
-      - aws.amazon.com/neuroncore
-  kunlun:
-    enabled: true
-    customresources:
-      - kunlunxin.com/xpu
-      - kunlunxin.com/vxpu
-      - kunlunxin.com/vxpu-memory
-  enflame:
-    enabled: true
-    customresources:
-      - enflame.com/vgcu
-      - enflame.com/vgcu-percentage
-      - enflame.com/gcu
-  mthreads:
-    enabled: true
-    customresources:
-      - mthreads.com/vgpu
-  nvidia:
-    gpuCorePolicy: default
-    libCudaLogLevel: 1
-  ascend:
-    enabled: false
-    image: ""
-    imagePullPolicy: IfNotPresent
-    extraArgs: []
-    nodeSelector:
-      ascend: "on"
-    tolerations: []
-    customresources:
-      - huawei.com/Ascend910A
-      - huawei.com/Ascend910A-memory
-      - huawei.com/Ascend910B2
-      - huawei.com/Ascend910B2-memory
-      - huawei.com/Ascend910B3
-      - huawei.com/Ascend910B3-memory
-      - huawei.com/Ascend910B4
-      - huawei.com/Ascend910B4-memory
-      - huawei.com/Ascend910B4-1
-      - huawei.com/Ascend910B4-1-memory
-      - huawei.com/Ascend310P
-      - huawei.com/Ascend310P-memory
-  iluvatar:
-    enabled: false
-    customresources:
-      - iluvatar.ai/BI-V100-vgpu
-      - iluvatar.ai/BI-V100.vCore
-      - iluvatar.ai/BI-V100.vMem
-      - iluvatar.ai/BI-V150-vgpu
-      - iluvatar.ai/BI-V150.vCore
-      - iluvatar.ai/BI-V150.vMem
-      - iluvatar.ai/MR-V100-vgpu
-      - iluvatar.ai/MR-V100.vCore
-      - iluvatar.ai/MR-V100.vMem
-      - iluvatar.ai/MR-V50-vgpu
-      - iluvatar.ai/MR-V50.vCore
-      - iluvatar.ai/MR-V50.vMem
diff --git a/packages/system/hami/values.yaml b/packages/system/hami/values.yaml
deleted file mode 100644
index 76e8d631..00000000
--- a/packages/system/hami/values.yaml
+++ /dev/null
@@ -1,17 +0,0 @@
-hami:
-  scheduler:
-    kubeScheduler:
-      image:
-        registry: registry.k8s.io
-        repository: kube-scheduler
-  devicePlugin:
-    runtimeClassName: nvidia
-    updateStrategy:
-      type: RollingUpdate
-    # See https://github.com/Project-HAMi/HAMi/blob/v2.8.1/deployments/charts/hami/values.yaml
-    # Each entry: {"name": "node-name", "operatingmode": "hami-core", "devicesplitcount": N, ...}
-    nodeConfiguration:
-      config: |
-        {
-          "nodeconfig": []
-        }
diff --git a/packages/system/kubeovn-plunger/images/kubeovn-plunger/Dockerfile b/packages/system/kubeovn-plunger/images/kubeovn-plunger/Dockerfile
index b0473244..7882503f 100644
--- a/packages/system/kubeovn-plunger/images/kubeovn-plunger/Dockerfile
+++ b/packages/system/kubeovn-plunger/images/kubeovn-plunger/Dockerfile
@@ -1,4 +1,4 @@
-FROM golang:1.25-alpine AS builder
+FROM golang:1.26-alpine AS builder
 
 ARG TARGETOS
 ARG TARGETARCH
@@ -19,4 +19,5 @@ FROM scratch
 COPY --from=builder /kubeovn-plunger /kubeovn-plunger
 COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
 
+USER 65532:65532
 ENTRYPOINT ["/kubeovn-plunger"]
diff --git a/packages/system/kubeovn-webhook/images/kubeovn-webhook/Dockerfile b/packages/system/kubeovn-webhook/images/kubeovn-webhook/Dockerfile
index 73d5e99b..8897f2b9 100644
--- a/packages/system/kubeovn-webhook/images/kubeovn-webhook/Dockerfile
+++ b/packages/system/kubeovn-webhook/images/kubeovn-webhook/Dockerfile
@@ -1,4 +1,4 @@
-FROM golang:1.23 AS builder
+FROM golang:1.26 AS builder
 
 ARG TARGETOS
 ARG TARGETARCH
diff --git a/packages/system/kubeovn-webhook/images/kubeovn-webhook/go.mod b/packages/system/kubeovn-webhook/images/kubeovn-webhook/go.mod
index 9befcd00..d8b4a754 100644
--- a/packages/system/kubeovn-webhook/images/kubeovn-webhook/go.mod
+++ b/packages/system/kubeovn-webhook/images/kubeovn-webhook/go.mod
@@ -1,6 +1,6 @@
 module kube-ovn-webhook
 
-go 1.23
+go 1.26.2
 
 require (
 	github.com/mattbaird/jsonpatch v0.0.0-20240118010651-0ba75a80ca38
@@ -19,7 +19,7 @@ require (
 	github.com/gogo/protobuf v1.3.2 // indirect
 	github.com/golang/protobuf v1.5.2 // indirect
 	github.com/google/gnostic v0.5.7-v3refs // indirect
-	github.com/google/go-cmp v0.5.9 // indirect
+	github.com/google/go-cmp v0.7.0 // indirect
 	github.com/google/gofuzz v1.1.0 // indirect
 	github.com/josharian/intern v1.0.0 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
@@ -27,14 +27,13 @@ require (
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
 	github.com/modern-go/reflect2 v1.0.2 // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
-	golang.org/x/net v0.3.1-0.20221206200815-1e63c2f08a10 // indirect
-	golang.org/x/oauth2 v0.0.0-20220223155221-ee480838109b // indirect
-	golang.org/x/sys v0.3.0 // indirect
-	golang.org/x/term v0.3.0 // indirect
-	golang.org/x/text v0.5.0 // indirect
+	golang.org/x/net v0.53.0 // indirect
+	golang.org/x/oauth2 v0.36.0 // indirect
+	golang.org/x/sys v0.43.0 // indirect
+	golang.org/x/term v0.42.0 // indirect
+	golang.org/x/text v0.36.0 // indirect
 	golang.org/x/time v0.0.0-20220210224613-90d013bbcef8 // indirect
-	google.golang.org/appengine v1.6.7 // indirect
-	google.golang.org/protobuf v1.28.1 // indirect
+	google.golang.org/protobuf v1.36.11 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
diff --git a/packages/system/kubeovn-webhook/images/kubeovn-webhook/go.sum b/packages/system/kubeovn-webhook/images/kubeovn-webhook/go.sum
index a2a4e312..62f9d175 100644
--- a/packages/system/kubeovn-webhook/images/kubeovn-webhook/go.sum
+++ b/packages/system/kubeovn-webhook/images/kubeovn-webhook/go.sum
@@ -1,44 +1,7 @@
 cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
-cloud.google.com/go v0.34.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
-cloud.google.com/go v0.38.0/go.mod h1:990N+gfupTy94rShfmMCWGDn0LpTmnzTp2qbd1dvSRU=
-cloud.google.com/go v0.44.1/go.mod h1:iSa0KzasP4Uvy3f1mN/7PiObzGgflwredwwASm/v6AU=
-cloud.google.com/go v0.44.2/go.mod h1:60680Gw3Yr4ikxnPRS/oxxkBccT6SA1yMk63TGekxKY=
-cloud.google.com/go v0.45.1/go.mod h1:RpBamKRgapWJb87xiFSdk4g1CME7QZg3uwTez+TSTjc=
-cloud.google.com/go v0.46.3/go.mod h1:a6bKKbmY7er1mI7TEI4lsAkts/mkhTSZK8w33B4RAg0=
-cloud.google.com/go v0.50.0/go.mod h1:r9sluTvynVuxRIOHXQEHMFffphuXHOMZMycpNR5e6To=
-cloud.google.com/go v0.52.0/go.mod h1:pXajvRH/6o3+F9jDHZWQ5PbGhn+o8w9qiu/CffaVdO4=
-cloud.google.com/go v0.53.0/go.mod h1:fp/UouUEsRkN6ryDKNW/Upv/JBKnv6WDthjR6+vze6M=
-cloud.google.com/go v0.54.0/go.mod h1:1rq2OEkV3YMf6n/9ZvGWI3GWw0VoqH/1x2nd8Is/bPc=
-cloud.google.com/go v0.56.0/go.mod h1:jr7tqZxxKOVYizybht9+26Z/gUq7tiRzu+ACVAMbKVk=
-cloud.google.com/go v0.57.0/go.mod h1:oXiQ6Rzq3RAkkY7N6t3TcE6jE+CIBBbA36lwQ1JyzZs=
-cloud.google.com/go v0.62.0/go.mod h1:jmCYTdRCQuc1PHIIJ/maLInMho30T/Y0M4hTdTShOYc=
-cloud.google.com/go v0.65.0/go.mod h1:O5N8zS7uWy9vkA9vayVHs65eM1ubvY4h553ofrNHObY=
-cloud.google.com/go/bigquery v1.0.1/go.mod h1:i/xbL2UlR5RvWAURpBYZTtm/cXjCha9lbfbpx4poX+o=
-cloud.google.com/go/bigquery v1.3.0/go.mod h1:PjpwJnslEMmckchkHFfq+HTD2DmtT67aNFKH1/VBDHE=
-cloud.google.com/go/bigquery v1.4.0/go.mod h1:S8dzgnTigyfTmLBfrtrhyYhwRxG72rYxvftPBK2Dvzc=
-cloud.google.com/go/bigquery v1.5.0/go.mod h1:snEHRnqQbz117VIFhE8bmtwIDY80NLUZUMb4Nv6dBIg=
-cloud.google.com/go/bigquery v1.7.0/go.mod h1://okPTzCYNXSlb24MZs83e2Do+h+VXtc4gLoIoXIAPc=
-cloud.google.com/go/bigquery v1.8.0/go.mod h1:J5hqkt3O0uAFnINi6JXValWIb1v0goeZM77hZzJN/fQ=
-cloud.google.com/go/datastore v1.0.0/go.mod h1:LXYbyblFSglQ5pkeyhO+Qmw7ukd3C+pD7TKLgZqpHYE=
-cloud.google.com/go/datastore v1.1.0/go.mod h1:umbIZjpQpHh4hmRpGhH4tLFup+FVzqBi1b3c64qFpCk=
-cloud.google.com/go/pubsub v1.0.1/go.mod h1:R0Gpsv3s54REJCy4fxDixWD93lHJMoZTyQ2kNxGRt3I=
-cloud.google.com/go/pubsub v1.1.0/go.mod h1:EwwdRX2sKPjnvnqCa270oGRyludottCI76h+R3AArQw=
-cloud.google.com/go/pubsub v1.2.0/go.mod h1:jhfEVHT8odbXTkndysNHCcx0awwzvfOlguIAii9o8iA=
-cloud.google.com/go/pubsub v1.3.1/go.mod h1:i+ucay31+CNRpDW4Lu78I4xXG+O1r/MAHgjpRVR+TSU=
-cloud.google.com/go/storage v1.0.0/go.mod h1:IhtSnM/ZTZV8YYJWCY8RULGVqBDmpoyjwiyrjsg+URw=
-cloud.google.com/go/storage v1.5.0/go.mod h1:tpKbwo567HUNpVclU5sGELwQWBDZ8gh0ZeosJ0Rtdos=
-cloud.google.com/go/storage v1.6.0/go.mod h1:N7U0C8pVQ/+NIKOBQyamJIeKQKkZ+mxpohlUTyfDhBk=
-cloud.google.com/go/storage v1.8.0/go.mod h1:Wv1Oy7z6Yz3DshWRJFhqM/UCfaWIRTdp0RXyy7KQOVs=
-cloud.google.com/go/storage v1.10.0/go.mod h1:FLPqc6j+Ki4BU591ie1oL6qBQGu2Bl/tZ9ullr3+Kg0=
-dmitri.shuralyov.com/gpu/mtl v0.0.0-20190408044501-666a987793e9/go.mod h1:H6x//7gZCb22OMCxBHrMx7a5I7Hp++hsVxbQ4BYO7hU=
 github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
-github.com/BurntSushi/xgb v0.0.0-20160522181843-27f122750802/go.mod h1:IVnqGOEym/WlBOVXweHU+Q+/VP0lqqI8lqeDx9IjBqo=
 github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
-github.com/chzyer/logex v1.1.10/go.mod h1:+Ywpsq7O8HXn0nuIou7OrIPyXbp3wmkHB+jjWRnGsAI=
-github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e/go.mod h1:nSuG5e5PlCu98SY8svDHJxuZscDgtXS6KTTbou5AhLI=
-github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMnBNeIyt5eFwwo7qiLfzFZmjNmxjkiQlU=
 github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
-github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
 github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
@@ -46,14 +9,10 @@ github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSs
 github.com/docopt/docopt-go v0.0.0-20180111231733-ee0de3bc6815/go.mod h1:WwZ+bS3ebgob9U8Nd0kOddGdZWjyMGR8Wziv+TBNwSE=
 github.com/emicklei/go-restful/v3 v3.9.0 h1:XwGDlfxEnQZzuopoqxwSEllNcCOM9DhhFyhFIIGKwxE=
 github.com/emicklei/go-restful/v3 v3.9.0/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc=
-github.com/envoyproxy/go-control-plane v0.9.0/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
 github.com/envoyproxy/go-control-plane v0.9.1-0.20191026205805-5f8ba28d4473/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
-github.com/envoyproxy/go-control-plane v0.9.4/go.mod h1:6rpuAdCZL397s3pYoYcLgu1mIlRU8Am5FuJP05cCM98=
 github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
 github.com/evanphx/json-patch v4.12.0+incompatible h1:4onqiflcdA9EOZ4RxV643DvftH5pOlLGNtQ5lPWQu84=
-github.com/go-gl/glfw v0.0.0-20190409004039-e6da0acd62b1/go.mod h1:vR7hzQXu2zJy9AVAgeJqvqgH9Q5CA+iKCZ2gyEVpxRU=
-github.com/go-gl/glfw/v3.3/glfw v0.0.0-20191125211704-12ad95a8df72/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
-github.com/go-gl/glfw/v3.3/glfw v0.0.0-20200222043503-6f7a984d4dc4/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
+github.com/evanphx/json-patch v4.12.0+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLiYLvXMP4fmwYFNcr97nuDLSk=
 github.com/go-logr/logr v1.2.0/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
 github.com/go-logr/logr v1.2.3 h1:2DntVwHkVopvECVRSlL5PSo9eG+cAkDCuckLubN+rq0=
 github.com/go-logr/logr v1.2.3/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
@@ -68,70 +27,34 @@ github.com/go-openapi/swag v0.19.14/go.mod h1:QYRuS/SOXUCsnplDa677K7+DxSOj6IPNl/
 github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
 github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
 github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
-github.com/golang/groupcache v0.0.0-20190702054246-869f871628b6/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
-github.com/golang/groupcache v0.0.0-20191227052852-215e87163ea7/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
-github.com/golang/groupcache v0.0.0-20200121045136-8c9f03a8e57e/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
 github.com/golang/mock v1.1.1/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
-github.com/golang/mock v1.2.0/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
-github.com/golang/mock v1.3.1/go.mod h1:sBzyDLLjw3U8JLTeZvSv8jJB+tU5PVekmnlKIyFUx0Y=
-github.com/golang/mock v1.4.0/go.mod h1:UOMv5ysSaYNkG+OFQykRIcU/QvvxJf3p21QfJ2Bt3cw=
-github.com/golang/mock v1.4.1/go.mod h1:UOMv5ysSaYNkG+OFQykRIcU/QvvxJf3p21QfJ2Bt3cw=
-github.com/golang/mock v1.4.3/go.mod h1:UOMv5ysSaYNkG+OFQykRIcU/QvvxJf3p21QfJ2Bt3cw=
-github.com/golang/mock v1.4.4/go.mod h1:l3mdAwkq5BuhzHwde/uurv3sEJeZMXNpwsxVWU71h+4=
 github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
-github.com/golang/protobuf v1.3.1/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
 github.com/golang/protobuf v1.3.2/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
-github.com/golang/protobuf v1.3.3/go.mod h1:vzj43D7+SQXF/4pzW/hwtAqwc6iTitCiVSaWz5lYuqw=
-github.com/golang/protobuf v1.3.4/go.mod h1:vzj43D7+SQXF/4pzW/hwtAqwc6iTitCiVSaWz5lYuqw=
-github.com/golang/protobuf v1.3.5/go.mod h1:6O5/vntMXwX2lRkT1hjjk0nAC1IDOTvTlVgjlRvqsdk=
 github.com/golang/protobuf v1.4.0-rc.1/go.mod h1:ceaxUfeHdC40wWswd/P6IGgMaK3YpKi5j83Wpe3EHw8=
 github.com/golang/protobuf v1.4.0-rc.1.0.20200221234624-67d41d38c208/go.mod h1:xKAWHe0F5eneWXFV3EuXVDTCmh+JuBKY0li0aMyXATA=
 github.com/golang/protobuf v1.4.0-rc.2/go.mod h1:LlEzMj4AhA7rCAGe4KMBDvJI+AwstrUpVNzEA03Pprs=
 github.com/golang/protobuf v1.4.0-rc.4.0.20200313231945-b860323f09d0/go.mod h1:WU3c8KckQ9AFe+yFwt9sWVRKCVIyN9cPHBJSNnbL67w=
 github.com/golang/protobuf v1.4.0/go.mod h1:jodUvKwWbYaEsadDk5Fwe5c77LiNKVO9IDvqG2KuDX0=
 github.com/golang/protobuf v1.4.1/go.mod h1:U8fpvMrcmy5pZrNK1lt4xCsGvpyWQ/VVv6QDs8UjoX8=
-github.com/golang/protobuf v1.4.2/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
 github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk=
 github.com/golang/protobuf v1.5.2 h1:ROPKBNFfQgOUMifHyP+KYbvpjbdoFNs+aK7DXlji0Tw=
 github.com/golang/protobuf v1.5.2/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
-github.com/google/btree v0.0.0-20180813153112-4030bb1f1f0c/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
-github.com/google/btree v1.0.0/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
 github.com/google/gnostic v0.5.7-v3refs h1:FhTMOKj2VhjpouxvWJAV1TL304uMlb9zcDqkl6cEI54=
 github.com/google/gnostic v0.5.7-v3refs/go.mod h1:73MKFl6jIHelAJNaBGFzt3SPtZULs9dYrGFt8OiIsHQ=
 github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M=
 github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
 github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
 github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.4.1/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.1/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.9 h1:O2Tfq5qg4qc4AmwVlvv0oLiVAGB7enBSJ2x2DqQFi38=
-github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
+github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
+github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
 github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
 github.com/google/gofuzz v1.1.0 h1:Hsa8mG0dQ46ij8Sl2AYJDUv1oA9/d6Vk+3LG99Oe02g=
 github.com/google/gofuzz v1.1.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
-github.com/google/martian v2.1.0+incompatible/go.mod h1:9I4somxYTbIHy5NJKHRl3wXiIaQGbYVAs8BPL6v8lEs=
-github.com/google/martian/v3 v3.0.0/go.mod h1:y5Zk1BBys9G+gd6Jrk0W3cC1+ELVxBWuIGO+w/tUAp0=
-github.com/google/pprof v0.0.0-20181206194817-3ea8567a2e57/go.mod h1:zfwlbNMJ+OItoe0UupaVj+oy1omPYYDuagoSzA8v9mc=
-github.com/google/pprof v0.0.0-20190515194954-54271f7e092f/go.mod h1:zfwlbNMJ+OItoe0UupaVj+oy1omPYYDuagoSzA8v9mc=
-github.com/google/pprof v0.0.0-20191218002539-d4f498aebedc/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
-github.com/google/pprof v0.0.0-20200212024743-f11f1df84d12/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
-github.com/google/pprof v0.0.0-20200229191704-1ebb73c60ed3/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
-github.com/google/pprof v0.0.0-20200430221834-fc25d7d30c6d/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
-github.com/google/pprof v0.0.0-20200708004538-1a94d8640e99/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
-github.com/google/renameio v0.1.0/go.mod h1:KWCgfxg9yswjAJkECMjeO8J8rahYeXnNhOm40UhjYkI=
-github.com/googleapis/gax-go/v2 v2.0.4/go.mod h1:0Wqv26UfaUD9n4G6kQubkQ+KchISgw+vpHVxEJEs9eg=
-github.com/googleapis/gax-go/v2 v2.0.5/go.mod h1:DWXyrwAJ9X0FpwwEdw+IPEYBICEFu5mhpdKc/us6bOk=
-github.com/hashicorp/golang-lru v0.5.0/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
-github.com/hashicorp/golang-lru v0.5.1/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
-github.com/ianlancetaylor/demangle v0.0.0-20181102032728-5e5cf60278f6/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc=
 github.com/josharian/intern v1.0.0 h1:vlS4z54oSdjm0bgjRigI+G1HpF+tI+9rE5LLzOg8HmY=
 github.com/josharian/intern v1.0.0/go.mod h1:5DoeVV0s6jJacbCEi61lwdGj/aVlrQvzHFFd8Hwg//Y=
 github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=
 github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
-github.com/jstemmer/go-junit-report v0.0.0-20190106144839-af01ea7f8024/go.mod h1:6v2b51hI/fHJwM22ozAgKL4VKDeJcHhJFhtBdhmNjmU=
-github.com/jstemmer/go-junit-report v0.9.1/go.mod h1:Brl9GWCQeLvo8nXZwPNNblvFj/XSXhF0NWZEnDohbsk=
 github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
 github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
 github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
@@ -156,288 +79,104 @@ github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8m
 github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e h1:fD57ERR4JtEqsWbfPhv4DMiApHyliiK5xCTNVSPiaAs=
 github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e/go.mod h1:zD1mROLANZcx1PVRCS0qkT7pwLkGfwJo4zjcN/Tysno=
 github.com/onsi/ginkgo/v2 v2.4.0 h1:+Ig9nvqgS5OBSACXNk15PLdp0U9XPYROt9CFzVdFGIs=
+github.com/onsi/ginkgo/v2 v2.4.0/go.mod h1:iHkDK1fKGcBoEHT5W7YBq4RFWaQulw+caOMkAt4OrFo=
 github.com/onsi/gomega v1.23.0 h1:/oxKu9c2HVap+F3PfKort2Hw5DEU+HGlW8n+tguWsys=
+github.com/onsi/gomega v1.23.0/go.mod h1:Z/NWtiqwBrwUt4/2loMmHL63EDLnYHmVbuBpDr2vQAg=
 github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
+github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
-github.com/rogpeppe/go-internal v1.3.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4=
 github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=
+github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 github.com/stoewer/go-strcase v1.2.0/go.mod h1:IBiWB2sKIp3wVVQ3Y035++gc+knqhUQag1KpM8ahLw8=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
-github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
 github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA=
 github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.8.0 h1:pSgiaMZlXftHpm5L7V1+rVB+AZJydKsMxsQBIJw4PKk=
-github.com/yuin/goldmark v1.1.25/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
+github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
 github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
-github.com/yuin/goldmark v1.1.32/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
-go.opencensus.io v0.21.0/go.mod h1:mSImk1erAIZhrmZN+AvHh14ztQfjbGwt4TtuofqLduU=
-go.opencensus.io v0.22.0/go.mod h1:+kGneAE2xo2IficOXnaByMWTGM9T73dGwxeWcUqIpI8=
-go.opencensus.io v0.22.2/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
-go.opencensus.io v0.22.3/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
-go.opencensus.io v0.22.4/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
-golang.org/x/crypto v0.0.0-20190510104115-cbcb75029529/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
-golang.org/x/crypto v0.0.0-20190605123033-f99c8df09eb5/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
-golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
-golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8=
-golang.org/x/exp v0.0.0-20190829153037-c13cbed26979/go.mod h1:86+5VVa7VpoJ4kLfm080zCjGlMRFzhUhsZKEZO7MGek=
-golang.org/x/exp v0.0.0-20191030013958-a1ab85dbe136/go.mod h1:JXzH8nQsPlswgeRAPE3MuO9GYsAcnJvJ4vnMwN/5qkY=
-golang.org/x/exp v0.0.0-20191129062945-2f5052295587/go.mod h1:2RIsYlXP63K8oxa1u096TMicItID8zy7Y6sNkU49FU4=
-golang.org/x/exp v0.0.0-20191227195350-da58074b4299/go.mod h1:2RIsYlXP63K8oxa1u096TMicItID8zy7Y6sNkU49FU4=
-golang.org/x/exp v0.0.0-20200119233911-0405dc783f0a/go.mod h1:2RIsYlXP63K8oxa1u096TMicItID8zy7Y6sNkU49FU4=
-golang.org/x/exp v0.0.0-20200207192155-f17229e696bd/go.mod h1:J/WKrq2StrnmMY6+EHIKF9dgMWnmCNThgcyBT1FY9mM=
-golang.org/x/exp v0.0.0-20200224162631-6cc2880d07d6/go.mod h1:3jZMyOhIsHpP37uCMkUooju7aAi5cS1Q23tOzKc+0MU=
-golang.org/x/image v0.0.0-20190227222117-0694c2d4d067/go.mod h1:kZ7UVZpmo3dzQBMxlp+ypCbDeSB+sBbTgSJuh5dn5js=
-golang.org/x/image v0.0.0-20190802002840-cff245a6509b/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=
 golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
 golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU=
-golang.org/x/lint v0.0.0-20190301231843-5614ed5bae6f/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
 golang.org/x/lint v0.0.0-20190313153728-d0100b6bd8b3/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
-golang.org/x/lint v0.0.0-20190409202823-959b441ac422/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
-golang.org/x/lint v0.0.0-20190909230951-414d861bb4ac/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
-golang.org/x/lint v0.0.0-20190930215403-16217165b5de/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
-golang.org/x/lint v0.0.0-20191125180803-fdd1cda4f05f/go.mod h1:5qLYkcX4OjUUV8bRuDixDT3tpyyb+LUpUlRWLxfhWrs=
-golang.org/x/lint v0.0.0-20200130185559-910be7a94367/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
-golang.org/x/lint v0.0.0-20200302205851-738671d3881b/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
-golang.org/x/mobile v0.0.0-20190312151609-d3739f865fa6/go.mod h1:z+o9i4GpDbdi3rU15maQ/Ox0txvL9dWGYEHz965HBQE=
-golang.org/x/mobile v0.0.0-20190719004257-d2bd2a29d028/go.mod h1:E/iHnbuqvinMTCcRqshq8CkpyQDoeVncDDYHnLhea+o=
-golang.org/x/mod v0.0.0-20190513183733-4bf6d317e70e/go.mod h1:mXi4GBBbnImb6dmsKGUJ2LatrhH/nqhxcFungHvyanc=
-golang.org/x/mod v0.1.0/go.mod h1:0QHyrYULN0/3qlju5TqG8bIK38QM8yzMo5ekMj3DlcY=
-golang.org/x/mod v0.1.1-0.20191105210325-c90efee705ee/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg=
-golang.org/x/mod v0.1.1-0.20191107180719-034126e5016b/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg=
 golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20190108225652-1e06a53dbb7e/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190213061140-3a22650c66bd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
-golang.org/x/net v0.0.0-20190501004415-9ce7a6920f09/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
-golang.org/x/net v0.0.0-20190503192946-f4e77d36d62c/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
-golang.org/x/net v0.0.0-20190603091049-60506f45cf65/go.mod h1:HSz+uSET+XFnRR8LxR5pz3Of3rY3CfYBVs4xY44aLks=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20190628185345-da137c7871d7/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20190724013045-ca1201d0de80/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20191209160850-c0dbc17a3553/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20200114155413-6afb5195e5aa/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20200202094626-16171245cfb2/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20200222125558-5a598a2470a0/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20200301022130-244492dfa37a/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20200324143707-d3edc9973b7e/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
-golang.org/x/net v0.0.0-20200501053045-e0ff5e5a1de5/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
-golang.org/x/net v0.0.0-20200506145744-7e3656a0809f/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
-golang.org/x/net v0.0.0-20200513185701-a91f0712d120/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
-golang.org/x/net v0.0.0-20200520182314-0ba52f642ac2/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
-golang.org/x/net v0.0.0-20200625001655-4c5254603344/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
-golang.org/x/net v0.0.0-20200707034311-ab3426394381/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
-golang.org/x/net v0.0.0-20200822124328-c89045814202/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
 golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
-golang.org/x/net v0.0.0-20220127200216-cd36cc0744dd/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
-golang.org/x/net v0.3.1-0.20221206200815-1e63c2f08a10 h1:Frnccbp+ok2GkUS2tC84yAq/U9Vg+0sIO7aRL3T4Xnc=
-golang.org/x/net v0.3.1-0.20221206200815-1e63c2f08a10/go.mod h1:MBQ8lrhLObU/6UmLb4fmbmk5OcyYmqtbGd/9yIeKjEE=
+golang.org/x/net v0.53.0 h1:d+qAbo5L0orcWAr0a9JweQpjXF19LMXJE8Ey7hwOdUA=
+golang.org/x/net v0.53.0/go.mod h1:JvMuJH7rrdiCfbeHoo3fCQU24Lf5JJwT9W3sJFulfgs=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
-golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
-golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
-golang.org/x/oauth2 v0.0.0-20191202225959-858c2ad4c8b6/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
-golang.org/x/oauth2 v0.0.0-20200107190931-bf48bf16ab8d/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
-golang.org/x/oauth2 v0.0.0-20220223155221-ee480838109b h1:clP8eMhB30EHdc0bd2Twtq6kgU7yl5ub2cQLSdrv1Dg=
-golang.org/x/oauth2 v0.0.0-20220223155221-ee480838109b/go.mod h1:DAh4E804XQdzx2j+YRIaUnCqCV2RuMz24cGBJ5QYIrc=
+golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=
+golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20190227155943-e225da77a7e6/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20200317015054-43a5402ce75a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20200625203802-6e8e738ad208/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20190312061237-fead79001313/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190502145724-3ef323f4f1fd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190507160741-ecd444e8653b/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190606165138-5da285871e9c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190624142023-c5567b49c5d0/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190726091711-fc99dfbffb4e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20191001151750-bb3f8db39f24/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20191204072324-ce4227a45e2e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20191228213918-04cbcbbfeed8/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200113162924-86b910548bc1/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200122134326-e047566fdf82/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200202164722-d101bd2416d5/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200212091648-12a6c2dcc1e4/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200223170610-d5e6a3e2c0ae/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200302150141-5c8b2ff67527/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200331124033-c3d80250170d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200501052902-10377860bb8e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200511232937-7e40ca221e25/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200515095857-1151b9dac4a9/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200523222454-059865788121/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200803210538-64077c9b5642/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20211216021012-1d35b9e2eb4e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.3.0 h1:w8ZOecv6NaNa/zC8944JTU3vz4u6Lagfk4RPQxv92NQ=
-golang.org/x/sys v0.3.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
-golang.org/x/term v0.3.0 h1:qoo4akIqOcDME5bhc/NgxUdovd6BSS2uMsVjB56q1xI=
-golang.org/x/term v0.3.0/go.mod h1:q750SLmJuPmVoN1blW3UFBPREJfb1KmY3vwxfr+nFDA=
-golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+golang.org/x/sys v0.43.0 h1:Rlag2XtaFTxp19wS8MXlJwTvoh8ArU6ezoyFsMyCTNI=
+golang.org/x/sys v0.43.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/term v0.42.0 h1:UiKe+zDFmJobeJ5ggPwOshJIVt6/Ft0rcfrXZDLWAWY=
+golang.org/x/term v0.42.0/go.mod h1:Dq/D+snpsbazcBG5+F9Q1n2rXV8Ma+71xEjTRufARgY=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
-golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
-golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
-golang.org/x/text v0.5.0 h1:OLmvp0KP+FVG99Ct/qFiL/Fhk4zp4QQnZ7b2U+5piUM=
-golang.org/x/text v0.5.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
-golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
-golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
-golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
+golang.org/x/text v0.36.0 h1:JfKh3XmcRPqZPKevfXVpI1wXPTqbkE5f7JA92a55Yxg=
+golang.org/x/text v0.36.0/go.mod h1:NIdBknypM8iqVmPiuco0Dh6P5Jcdk8lJL0CUebqK164=
 golang.org/x/time v0.0.0-20220210224613-90d013bbcef8 h1:vVKdlvoWBphwdxWKrFZEuM0kGgGLxUOYcY4U/2Vjg44=
 golang.org/x/time v0.0.0-20220210224613-90d013bbcef8/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY=
 golang.org/x/tools v0.0.0-20190311212946-11955173bddd/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
-golang.org/x/tools v0.0.0-20190312151545-0bb0c0a6e846/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
-golang.org/x/tools v0.0.0-20190312170243-e65039ee4138/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
-golang.org/x/tools v0.0.0-20190425150028-36563e24a262/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
-golang.org/x/tools v0.0.0-20190506145303-2d16b83fe98c/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
 golang.org/x/tools v0.0.0-20190524140312-2c0ae7006135/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
-golang.org/x/tools v0.0.0-20190606124116-d0a3d012864b/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
-golang.org/x/tools v0.0.0-20190621195816-6e04913cbbac/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
-golang.org/x/tools v0.0.0-20190628153133-6cdbf07be9d0/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
-golang.org/x/tools v0.0.0-20190816200558-6889da9d5479/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20190911174233-4f2ddba30aff/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20191012152004-8de300cfc20a/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20191113191852-77e3bb0ad9e7/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20191115202509-3a792d9c32b2/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20191125144606-a911d9008d1f/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20191130070609-6e064ea0cf2d/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20191216173652-a0e659d51361/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20191227053925-7b8e75db28f4/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20200117161641-43d50277825c/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20200122220014-bf1340f18c4a/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20200130002326-2f3ba24bd6e7/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20200204074204-1cc6d1ef6c74/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20200207183749-b753a1ba74fa/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20200212150539-ea181f53ac56/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20200224181240-023911ca70b2/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20200227222343-706bc42d1f0d/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20200304193943-95d2e580d8eb/go.mod h1:o4KQGtdN14AW+yjsvvwRTJJuXz8XRtIHtEnmAXLyFUw=
-golang.org/x/tools v0.0.0-20200312045724-11d5b4c81c7d/go.mod h1:o4KQGtdN14AW+yjsvvwRTJJuXz8XRtIHtEnmAXLyFUw=
-golang.org/x/tools v0.0.0-20200331025713-a30bf2db82d4/go.mod h1:Sl4aGygMT6LrqrWclx+PTx3U+LnKx/seiNR+3G19Ar8=
-golang.org/x/tools v0.0.0-20200501065659-ab2804fb9c9d/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
-golang.org/x/tools v0.0.0-20200512131952-2bc93b1c0c88/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
-golang.org/x/tools v0.0.0-20200515010526-7d3b6ebf133d/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
-golang.org/x/tools v0.0.0-20200618134242-20370b0cb4b2/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
 golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
-golang.org/x/tools v0.0.0-20200729194436-6467de6f59a7/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA=
-golang.org/x/tools v0.0.0-20200804011535-6c149bb5ef0d/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA=
-golang.org/x/tools v0.0.0-20200825202427-b303f430e36d/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA=
 golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-google.golang.org/api v0.4.0/go.mod h1:8k5glujaEP+g9n7WNsDg8QP6cUVNI86fCNMcbazEtwE=
-google.golang.org/api v0.7.0/go.mod h1:WtwebWUNSVBH/HAw79HIFXZNqEvBhG+Ra+ax0hx3E3M=
-google.golang.org/api v0.8.0/go.mod h1:o4eAsZoiT+ibD93RtjEohWalFOjRDx6CVaqeizhEnKg=
-google.golang.org/api v0.9.0/go.mod h1:o4eAsZoiT+ibD93RtjEohWalFOjRDx6CVaqeizhEnKg=
-google.golang.org/api v0.13.0/go.mod h1:iLdEw5Ide6rF15KTC1Kkl0iskquN2gFfn9o9XIsbkAI=
-google.golang.org/api v0.14.0/go.mod h1:iLdEw5Ide6rF15KTC1Kkl0iskquN2gFfn9o9XIsbkAI=
-google.golang.org/api v0.15.0/go.mod h1:iLdEw5Ide6rF15KTC1Kkl0iskquN2gFfn9o9XIsbkAI=
-google.golang.org/api v0.17.0/go.mod h1:BwFmGc8tA3vsd7r/7kR8DY7iEEGSU04BFxCo5jP/sfE=
-google.golang.org/api v0.18.0/go.mod h1:BwFmGc8tA3vsd7r/7kR8DY7iEEGSU04BFxCo5jP/sfE=
-google.golang.org/api v0.19.0/go.mod h1:BwFmGc8tA3vsd7r/7kR8DY7iEEGSU04BFxCo5jP/sfE=
-google.golang.org/api v0.20.0/go.mod h1:BwFmGc8tA3vsd7r/7kR8DY7iEEGSU04BFxCo5jP/sfE=
-google.golang.org/api v0.22.0/go.mod h1:BwFmGc8tA3vsd7r/7kR8DY7iEEGSU04BFxCo5jP/sfE=
-google.golang.org/api v0.24.0/go.mod h1:lIXQywCXRcnZPGlsd8NbLnOjtAoL6em04bJ9+z0MncE=
-google.golang.org/api v0.28.0/go.mod h1:lIXQywCXRcnZPGlsd8NbLnOjtAoL6em04bJ9+z0MncE=
-google.golang.org/api v0.29.0/go.mod h1:Lcubydp8VUV7KeIHD9z2Bys/sm/vGKnG1UHuDBSrHWM=
-google.golang.org/api v0.30.0/go.mod h1:QGmEvQ87FHZNiUVJkT14jQNYJ4ZJjdRF23ZXz5138Fc=
 google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
 google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
-google.golang.org/appengine v1.5.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
-google.golang.org/appengine v1.6.1/go.mod h1:i06prIuMbXzDqacNJfV5OdTW448YApPu5ww/cMBSeb0=
-google.golang.org/appengine v1.6.5/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
-google.golang.org/appengine v1.6.6/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
-google.golang.org/appengine v1.6.7 h1:FZR1q0exgwxzPzp/aF+VccGrSfxfPpkBqjIIEq3ru6c=
-google.golang.org/appengine v1.6.7/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
 google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
-google.golang.org/genproto v0.0.0-20190307195333-5fe7a883aa19/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
-google.golang.org/genproto v0.0.0-20190418145605-e7d98fc518a7/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
-google.golang.org/genproto v0.0.0-20190425155659-357c62f0e4bb/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
-google.golang.org/genproto v0.0.0-20190502173448-54afdca5d873/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
-google.golang.org/genproto v0.0.0-20190801165951-fa694d86fc64/go.mod h1:DMBHOl98Agz4BDEuKkezgsaosCRResVns1a3J2ZsMNc=
 google.golang.org/genproto v0.0.0-20190819201941-24fa4b261c55/go.mod h1:DMBHOl98Agz4BDEuKkezgsaosCRResVns1a3J2ZsMNc=
-google.golang.org/genproto v0.0.0-20190911173649-1774047e7e51/go.mod h1:IbNlFCBrqXvoKpeg0TB2l7cyZUmoaFKYIwrEpbDKLA8=
-google.golang.org/genproto v0.0.0-20191108220845-16a3f7862a1a/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
-google.golang.org/genproto v0.0.0-20191115194625-c23dd37a84c9/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
-google.golang.org/genproto v0.0.0-20191216164720-4f79533eabd1/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
-google.golang.org/genproto v0.0.0-20191230161307-f3c370f40bfb/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
-google.golang.org/genproto v0.0.0-20200115191322-ca5a22157cba/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
-google.golang.org/genproto v0.0.0-20200122232147-0452cf42e150/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
-google.golang.org/genproto v0.0.0-20200204135345-fa8e72b47b90/go.mod h1:GmwEX6Z4W5gMy59cAlVYjN9JhxgbQH6Gn+gFDQe2lzA=
-google.golang.org/genproto v0.0.0-20200212174721-66ed5ce911ce/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
-google.golang.org/genproto v0.0.0-20200224152610-e50cd9704f63/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
-google.golang.org/genproto v0.0.0-20200228133532-8c2c7df3a383/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
-google.golang.org/genproto v0.0.0-20200305110556-506484158171/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
-google.golang.org/genproto v0.0.0-20200312145019-da6875a35672/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
-google.golang.org/genproto v0.0.0-20200331122359-1ee6d9798940/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
-google.golang.org/genproto v0.0.0-20200430143042-b979b6f78d84/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
-google.golang.org/genproto v0.0.0-20200511104702-f5ebc3bea380/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
-google.golang.org/genproto v0.0.0-20200515170657-fc4c6c6a6587/go.mod h1:YsZOwe1myG/8QRHRsmBRE1LrgQY60beZKjly0O1fX9U=
 google.golang.org/genproto v0.0.0-20200526211855-cb27e3aa2013/go.mod h1:NbSheEEYHJ7i3ixzK3sjbqSGDJWnxyFXZblF3eUsNvo=
-google.golang.org/genproto v0.0.0-20200618031413-b414f8b61790/go.mod h1:jDfRM7FcilCzHH/e9qn6dsT145K34l5v+OpcnNgKAAA=
-google.golang.org/genproto v0.0.0-20200729003335-053ba62fc06f/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20200804131852-c06518451d9c/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20200825200019-8632dd797987/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
 google.golang.org/genproto v0.0.0-20201019141844-1ed22bb0c154/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
 google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
-google.golang.org/grpc v1.20.1/go.mod h1:10oTOabMzJvdu6/UiuZezV6QK5dSlG84ov/aaiqXj38=
-google.golang.org/grpc v1.21.1/go.mod h1:oYelfM1adQP15Ek0mdvEgi9Df8B9CZIaU1084ijfRaM=
 google.golang.org/grpc v1.23.0/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg=
-google.golang.org/grpc v1.25.1/go.mod h1:c3i+UQWmh7LiEpx4sFZnkU36qjEYZ0imhYfXVyQciAY=
-google.golang.org/grpc v1.26.0/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk=
 google.golang.org/grpc v1.27.0/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk=
-google.golang.org/grpc v1.27.1/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk=
-google.golang.org/grpc v1.28.0/go.mod h1:rpkK4SK4GF4Ach/+MFLZUBavHOvF2JJB5uozKKal+60=
-google.golang.org/grpc v1.29.1/go.mod h1:itym6AZVZYACWQqET3MqgPpjcuV5QH3BxFS3IjizoKk=
-google.golang.org/grpc v1.30.0/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak=
-google.golang.org/grpc v1.31.0/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak=
 google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
 google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
 google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=
 google.golang.org/protobuf v1.20.1-0.20200309200217-e05f789c0967/go.mod h1:A+miEFZTKqfCUM6K7xSMQL9OKL/b6hQv+e19PK+JZNE=
 google.golang.org/protobuf v1.21.0/go.mod h1:47Nbq4nVaFHyn7ilMalzfO3qCViNmqZ2kzikPIcrTAo=
 google.golang.org/protobuf v1.22.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
-google.golang.org/protobuf v1.23.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
 google.golang.org/protobuf v1.23.1-0.20200526195155-81db48ad09cc/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
 google.golang.org/protobuf v1.24.0/go.mod h1:r/3tXBNzIEhYS9I1OUVjXDlt8tc493IdKGjtUeSXeh4=
-google.golang.org/protobuf v1.25.0/go.mod h1:9JNX74DMeImyA3h4bdi1ymwjUzf21/xIlbajtzgsN7c=
 google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
 google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
-google.golang.org/protobuf v1.28.1 h1:d0NfwRgPtno5B1Wa6L2DAG+KivqkdutMf1UhdNx175w=
-google.golang.org/protobuf v1.28.1/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
+google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
+google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20200227125254-8fa46927fb4f h1:BLraFXnmrev5lT+xlilqcH8XK9/i0At2xKjWk4p6zsU=
 gopkg.in/check.v1 v1.0.0-20200227125254-8fa46927fb4f/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/errgo.v2 v2.1.0/go.mod h1:hNsd1EY+bozCKY1Ytp96fpM3vjJbqLJn88ws8XvfDNI=
 gopkg.in/inf.v0 v0.9.1 h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc=
 gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
 gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
@@ -449,12 +188,7 @@ gopkg.in/yaml.v3 v3.0.0-20200615113413-eeeca48fe776/go.mod h1:K4uyk7z7BCEPqu6E+C
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
-honnef.co/go/tools v0.0.0-20190106161140-3f1c8253044a/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
-honnef.co/go/tools v0.0.0-20190418001031-e561f6794a2a/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
 honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
-honnef.co/go/tools v0.0.1-2019.2.3/go.mod h1:a3bituU0lyd329TUQxRnasdCoJDkEUEAqEt0JzvZhAg=
-honnef.co/go/tools v0.0.1-2020.1.3/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
-honnef.co/go/tools v0.0.1-2020.1.4/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
 k8s.io/api v0.26.0 h1:IpPlZnxBpV1xl7TGk/X6lFtpgjgntCg8PJ+qrPHAC7I=
 k8s.io/api v0.26.0/go.mod h1:k6HDTaIFC8yn1i6pSClSqIwLABIcLV9l5Q4EcngKnQg=
 k8s.io/apimachinery v0.26.0 h1:1feANjElT7MvPqp0JT6F3Ss6TWDwmcjLypwoPpEf7zg=
@@ -467,9 +201,6 @@ k8s.io/kube-openapi v0.0.0-20221012153701-172d655c2280 h1:+70TFaan3hfJzs+7VK2o+O
 k8s.io/kube-openapi v0.0.0-20221012153701-172d655c2280/go.mod h1:+Axhij7bCpeqhklhUTe3xmOn6bWxolyZEeyaFpjGtl4=
 k8s.io/utils v0.0.0-20221107191617-1a15be271d1d h1:0Smp/HP1OH4Rvhe+4B8nWGERtlqAGSftbSbbmm45oFs=
 k8s.io/utils v0.0.0-20221107191617-1a15be271d1d/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
-rsc.io/binaryregexp v0.2.0/go.mod h1:qTv7/COck+e2FymRvadv62gMdZztPaShugOCi3I+8D8=
-rsc.io/quote/v3 v3.1.0/go.mod h1:yEA65RcK8LyAZtP9Kv3t0HmxON59tX3rD+tICJqUlj0=
-rsc.io/sampler v1.3.0/go.mod h1:T1hPZKmBbMNahiBKFy5HrXp6adAjACjK9JXDnKaTXpA=
 sigs.k8s.io/json v0.0.0-20220713155537-f223a00ba0e2 h1:iXTIw73aPyC+oRdyqqvVJuloN1p0AC/kzH07hu3NE+k=
 sigs.k8s.io/json v0.0.0-20220713155537-f223a00ba0e2/go.mod h1:B8JuhiUyNFVKdsE8h686QcCxMaH6HrOAZj4vswFpcB0=
 sigs.k8s.io/structured-merge-diff/v4 v4.2.3 h1:PRbqxJClWWYMNV1dhaG4NsibJbArud9kFxnAMREiWFE=
diff --git a/packages/system/kubernetes-rd/cozyrds/kubernetes.yaml b/packages/system/kubernetes-rd/cozyrds/kubernetes.yaml
index f81eaff0..5e9e8f94 100644
--- a/packages/system/kubernetes-rd/cozyrds/kubernetes.yaml
+++ b/packages/system/kubernetes-rd/cozyrds/kubernetes.yaml
@@ -2,27 +2,13 @@ apiVersion: cozystack.io/v1alpha1
 kind: ApplicationDefinition
 metadata:
   name: kubernetes
-  annotations:
-    # Kubernetes tenants boot a Kamaji control plane whose admin-kubeconfig
-    # Secret is provisioned asynchronously. Cold Kamaji start (image pull +
-    # etcd + apiserver Ready) plus admin-kubeconfig generation can exceed
-    # Flux helm-controller's default wait budget, causing remediation loops
-    # that uninstall the Cluster CR. This override is applied by cozystack-api
-    # to the HelmRelease Spec.Install.Timeout and Spec.Upgrade.Timeout.
-    #
-    # Coupling: the wait-for-kubeconfig init container in
-    # packages/apps/kubernetes/templates/_helpers.tpl hard-codes a 10m
-    # deadline chosen to stay strictly below this value so the pod's
-    # CrashLoopBackOff surfaces before flux remediation fires. If this
-    # annotation is raised, update that init deadline correspondingly.
-    release.cozystack.io/helm-install-timeout: "15m"
 spec:
   application:
     kind: Kubernetes
     singular: kubernetes
     plural: kuberneteses
     openAPISchema: |-
-      {"title":"Chart Values","type":"object","properties":{"storageClass":{"description":"StorageClass used to store the data.","type":"string","default":"replicated"},"nodeGroups":{"description":"Worker nodes configuration map.","type":"object","default":{"md0":{"ephemeralStorage":"20Gi","gpus":[],"instanceType":"u1.medium","maxReplicas":10,"minReplicas":0,"resources":{},"roles":["ingress-nginx"]}},"additionalProperties":{"type":"object","required":["ephemeralStorage","instanceType","maxReplicas","minReplicas","resources"],"properties":{"ephemeralStorage":{"description":"Ephemeral storage size.","default":"20Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"gpus":{"description":"List of GPUs to attach (NVIDIA driver requires at least 4 GiB RAM).","type":"array","items":{"type":"object","required":["name"],"properties":{"name":{"description":"Name of GPU, such as \"nvidia.com/AD102GL_L40S\".","type":"string"}}}},"instanceType":{"description":"Virtual machine instance type.","type":"string","default":"u1.medium"},"maxReplicas":{"description":"Maximum number of replicas.","type":"integer","default":10},"minReplicas":{"description":"Minimum number of replicas.","type":"integer","default":0},"resources":{"description":"CPU and memory resources for each worker node.","type":"object","properties":{"cpu":{"description":"CPU available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"roles":{"description":"List of node roles.","type":"array","items":{"type":"string"}}}}},"version":{"description":"Kubernetes major.minor version to deploy","type":"string","default":"v1.35","enum":["v1.35","v1.34","v1.33","v1.32","v1.31","v1.30"]},"host":{"description":"External hostname for Kubernetes cluster. Defaults to `<cluster-name>.<tenant-host>` if empty.","type":"string","default":""},"addons":{"description":"Cluster addons configuration.","type":"object","default":{},"required":["certManager","cilium","coredns","fluxcd","gatewayAPI","gpuOperator","hami","ingressNginx","monitoringAgents","velero","verticalPodAutoscaler"],"properties":{"certManager":{"description":"Cert-manager addon.","type":"object","default":{},"required":["enabled","valuesOverride"],"properties":{"enabled":{"description":"Enable cert-manager.","type":"boolean","default":false},"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}},"cilium":{"description":"Cilium CNI plugin.","type":"object","default":{},"required":["valuesOverride"],"properties":{"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}},"coredns":{"description":"CoreDNS addon.","type":"object","default":{},"required":["valuesOverride"],"properties":{"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}},"fluxcd":{"description":"FluxCD GitOps operator.","type":"object","default":{},"required":["enabled","valuesOverride"],"properties":{"enabled":{"description":"Enable FluxCD.","type":"boolean","default":false},"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}},"gatewayAPI":{"description":"Gateway API addon.","type":"object","default":{},"required":["enabled"],"properties":{"enabled":{"description":"Enable Gateway API.","type":"boolean","default":false}}},"gpuOperator":{"description":"NVIDIA GPU Operator.","type":"object","default":{},"required":["enabled","valuesOverride"],"properties":{"enabled":{"description":"Enable GPU Operator.","type":"boolean","default":false},"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}},"hami":{"description":"HAMi GPU virtualization middleware.","type":"object","default":{},"required":["enabled","valuesOverride"],"properties":{"enabled":{"description":"Enable HAMi (requires GPU Operator).","type":"boolean","default":false},"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}},"ingressNginx":{"description":"Ingress-NGINX controller.","type":"object","default":{},"required":["enabled","exposeMethod","valuesOverride"],"properties":{"enabled":{"description":"Enable the controller (requires nodes labeled `ingress-nginx`).","type":"boolean","default":false},"exposeMethod":{"description":"Method to expose the controller. Allowed values: `Proxied`, `LoadBalancer`.","type":"string","default":"Proxied","enum":["Proxied","LoadBalancer"]},"hosts":{"description":"Domains routed to this tenant cluster when `exposeMethod` is `Proxied`.","type":"array","default":[],"items":{"type":"string"}},"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}},"monitoringAgents":{"description":"Monitoring agents.","type":"object","default":{},"required":["enabled","valuesOverride"],"properties":{"enabled":{"description":"Enable monitoring agents.","type":"boolean","default":false},"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}},"velero":{"description":"Velero backup/restore addon.","type":"object","default":{},"required":["enabled","valuesOverride"],"properties":{"enabled":{"description":"Enable Velero.","type":"boolean","default":false},"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}},"verticalPodAutoscaler":{"description":"Vertical Pod Autoscaler.","type":"object","default":{},"required":["valuesOverride"],"properties":{"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}}}},"controlPlane":{"description":"Kubernetes control-plane configuration.","type":"object","default":{},"required":["apiServer","controllerManager","konnectivity","replicas","scheduler"],"properties":{"apiServer":{"description":"API Server configuration.","type":"object","default":{},"required":["resources","resourcesPreset"],"properties":{"resources":{"description":"CPU and memory resources for API Server.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Preset if `resources` omitted.","type":"string","default":"large","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}},"controllerManager":{"description":"Controller Manager configuration.","type":"object","default":{},"required":["resources","resourcesPreset"],"properties":{"resources":{"description":"CPU and memory resources for Controller Manager.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Preset if `resources` omitted.","type":"string","default":"micro","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}},"konnectivity":{"description":"Konnectivity configuration.","type":"object","default":{},"required":["server"],"properties":{"server":{"description":"Konnectivity Server configuration.","type":"object","default":{},"required":["resources","resourcesPreset"],"properties":{"resources":{"description":"CPU and memory resources for Konnectivity.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Preset if `resources` omitted.","type":"string","default":"micro","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}}}},"replicas":{"description":"Number of control-plane replicas.","type":"integer","default":2},"scheduler":{"description":"Scheduler configuration.","type":"object","default":{},"required":["resources","resourcesPreset"],"properties":{"resources":{"description":"CPU and memory resources for Scheduler.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Preset if `resources` omitted.","type":"string","default":"micro","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}}}},"images":{"description":"Optional image overrides for air-gapped or rate-limited registries.","type":"object","default":{},"properties":{"waitForKubeconfig":{"description":"Image used by the wait-for-kubeconfig init container. Empty falls back to images/busybox.tag.","type":"string","default":""}}}}}
+      {"title":"Chart Values","type":"object","properties":{"storageClass":{"description":"StorageClass used to store the data.","type":"string","default":"replicated"},"nodeGroups":{"description":"Worker nodes configuration map.","type":"object","default":{"md0":{"ephemeralStorage":"20Gi","gpus":[],"instanceType":"u1.medium","maxReplicas":10,"minReplicas":0,"resources":{},"roles":["ingress-nginx"]}},"additionalProperties":{"type":"object","required":["ephemeralStorage","instanceType","maxReplicas","minReplicas","resources"],"properties":{"ephemeralStorage":{"description":"Ephemeral storage size.","default":"20Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"gpus":{"description":"List of GPUs to attach (NVIDIA driver requires at least 4 GiB RAM).","type":"array","items":{"type":"object","required":["name"],"properties":{"name":{"description":"Name of GPU, such as \"nvidia.com/AD102GL_L40S\".","type":"string"}}}},"instanceType":{"description":"Virtual machine instance type.","type":"string","default":"u1.medium"},"maxReplicas":{"description":"Maximum number of replicas.","type":"integer","default":10},"minReplicas":{"description":"Minimum number of replicas.","type":"integer","default":0},"resources":{"description":"CPU and memory resources for each worker node.","type":"object","properties":{"cpu":{"description":"CPU available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"roles":{"description":"List of node roles.","type":"array","items":{"type":"string"}}}}},"version":{"description":"Kubernetes major.minor version to deploy","type":"string","default":"v1.35","enum":["v1.35","v1.34","v1.33","v1.32","v1.31","v1.30"]},"host":{"description":"External hostname for Kubernetes cluster. Defaults to `<cluster-name>.<tenant-host>` if empty.","type":"string","default":""},"addons":{"description":"Cluster addons configuration.","type":"object","default":{},"required":["certManager","cilium","coredns","fluxcd","gatewayAPI","gpuOperator","ingressNginx","monitoringAgents","velero","verticalPodAutoscaler"],"properties":{"certManager":{"description":"Cert-manager addon.","type":"object","default":{},"required":["enabled","valuesOverride"],"properties":{"enabled":{"description":"Enable cert-manager.","type":"boolean","default":false},"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}},"cilium":{"description":"Cilium CNI plugin.","type":"object","default":{},"required":["valuesOverride"],"properties":{"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}},"coredns":{"description":"CoreDNS addon.","type":"object","default":{},"required":["valuesOverride"],"properties":{"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}},"fluxcd":{"description":"FluxCD GitOps operator.","type":"object","default":{},"required":["enabled","valuesOverride"],"properties":{"enabled":{"description":"Enable FluxCD.","type":"boolean","default":false},"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}},"gatewayAPI":{"description":"Gateway API addon.","type":"object","default":{},"required":["enabled"],"properties":{"enabled":{"description":"Enable Gateway API.","type":"boolean","default":false}}},"gpuOperator":{"description":"NVIDIA GPU Operator.","type":"object","default":{},"required":["enabled","valuesOverride"],"properties":{"enabled":{"description":"Enable GPU Operator.","type":"boolean","default":false},"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}},"ingressNginx":{"description":"Ingress-NGINX controller.","type":"object","default":{},"required":["enabled","exposeMethod","valuesOverride"],"properties":{"enabled":{"description":"Enable the controller (requires nodes labeled `ingress-nginx`).","type":"boolean","default":false},"exposeMethod":{"description":"Method to expose the controller. Allowed values: `Proxied`, `LoadBalancer`.","type":"string","default":"Proxied","enum":["Proxied","LoadBalancer"]},"hosts":{"description":"Domains routed to this tenant cluster when `exposeMethod` is `Proxied`.","type":"array","default":[],"items":{"type":"string"}},"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}},"monitoringAgents":{"description":"Monitoring agents.","type":"object","default":{},"required":["enabled","valuesOverride"],"properties":{"enabled":{"description":"Enable monitoring agents.","type":"boolean","default":false},"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}},"velero":{"description":"Velero backup/restore addon.","type":"object","default":{},"required":["enabled","valuesOverride"],"properties":{"enabled":{"description":"Enable Velero.","type":"boolean","default":false},"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}},"verticalPodAutoscaler":{"description":"Vertical Pod Autoscaler.","type":"object","default":{},"required":["valuesOverride"],"properties":{"valuesOverride":{"description":"Custom Helm values overrides.","type":"object","default":{},"x-kubernetes-preserve-unknown-fields":true}}}}},"controlPlane":{"description":"Kubernetes control-plane configuration.","type":"object","default":{},"required":["apiServer","controllerManager","konnectivity","replicas","scheduler"],"properties":{"apiServer":{"description":"API Server configuration.","type":"object","default":{},"required":["resources","resourcesPreset"],"properties":{"resources":{"description":"CPU and memory resources for API Server.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Preset if `resources` omitted.","type":"string","default":"large","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}},"controllerManager":{"description":"Controller Manager configuration.","type":"object","default":{},"required":["resources","resourcesPreset"],"properties":{"resources":{"description":"CPU and memory resources for Controller Manager.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Preset if `resources` omitted.","type":"string","default":"micro","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}},"konnectivity":{"description":"Konnectivity configuration.","type":"object","default":{},"required":["server"],"properties":{"server":{"description":"Konnectivity Server configuration.","type":"object","default":{},"required":["resources","resourcesPreset"],"properties":{"resources":{"description":"CPU and memory resources for Konnectivity.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Preset if `resources` omitted.","type":"string","default":"micro","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}}}},"replicas":{"description":"Number of control-plane replicas.","type":"integer","default":2},"scheduler":{"description":"Scheduler configuration.","type":"object","default":{},"required":["resources","resourcesPreset"],"properties":{"resources":{"description":"CPU and memory resources for Scheduler.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Preset if `resources` omitted.","type":"string","default":"micro","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]}}}}}}}
   release:
     prefix: kubernetes-
     labels:
@@ -40,7 +26,7 @@ spec:
     tags:
       - compute
     icon: PHN2ZyB3aWR0aD0iMTQ0IiBoZWlnaHQ9IjE0NCIgdmlld0JveD0iMCAwIDE0NCAxNDQiIGZpbGw9Im5vbmUiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyI+CjxyZWN0IHdpZHRoPSIxNDQiIGhlaWdodD0iMTQ0IiByeD0iMjQiIGZpbGw9InVybCgjcGFpbnQwX2xpbmVhcl82ODFfMjg0NSkiLz4KPHBhdGggZD0iTTcxLjk5NjggMTlDNzAuMzAzOSAxOS4wMDAyIDY4LjkzMTIgMjAuNTMyMiA2OC45MzE0IDIyLjQyMjFDNjguOTMxNCAyMi40NTExIDY4LjkzNzMgMjIuNDc4OCA2OC45Mzc5IDIyLjUwNzZDNjguOTM1NCAyMi43NjQ0IDY4LjkyMzEgMjMuMDczNyA2OC45MzE0IDIzLjI5NzNDNjguOTcxNyAyNC4zODczIDY5LjIwODIgMjUuMjIxNiA2OS4zNTA2IDI2LjIyNThDNjkuNjA4NCAyOC4zNzUyIDY5LjgyNDUgMzAuMTU2OSA2OS42OTEyIDMxLjgxM0M2OS41NjE1IDMyLjQzNzUgNjkuMTAzNyAzMy4wMDg2IDY4LjY5NTYgMzMuNDA1Nkw2OC42MjM1IDM0LjcwODZDNjYuNzgzOSAzNC44NjE3IDY0LjkzMTkgMzUuMTQyMSA2My4wODIxIDM1LjU2NDFDNTUuMTIyNiAzNy4zNzk4IDQ4LjI2OTUgNDEuNDk5MSA0My4wNTIgNDcuMDYwOUM0Mi43MTM0IDQ2LjgyODggNDIuMTIxMSA0Ni40MDE5IDQxLjk0NSA0Ni4yNzEyQzQxLjM5NzcgNDYuMzQ1NCA0MC44NDQ1IDQ2LjUxNTEgNDAuMTI0MSA0Ni4wOTM1QzM4Ljc1MjIgNDUuMTY1NyAzNy41MDI4IDQzLjg4NTEgMzUuOTkxIDQyLjM0MjRDMzUuMjk4MiA0MS42MDQ0IDM0Ljc5NjYgNDAuOTAxOCAzMy45NzM1IDQwLjE5MDRDMzMuNzg2NiA0MC4wMjg5IDMzLjUwMTQgMzkuODEwNCAzMy4yOTIzIDM5LjY0NDJDMzIuNjQ4OSAzOS4xMjg4IDMxLjg5IDM4Ljg2IDMxLjE1NyAzOC44MzQ4QzMwLjIxNDcgMzguODAyNCAyOS4zMDc1IDM5LjE3MjUgMjguNzEzOCAzOS45MjA2QzI3LjY1ODQgNDEuMjUwNiAyNy45OTYzIDQzLjI4MzMgMjkuNDY3MSA0NC40NjE0QzI5LjQ4MiA0NC40NzM0IDI5LjQ5NzkgNDQuNDgyNyAyOS41MTI5IDQ0LjQ5NDNDMjkuNzE1IDQ0LjY1ODkgMjkuOTYyNSA0NC44Njk4IDMwLjE0ODMgNDUuMDA3NkMzMS4wMjE3IDQ1LjY1NTUgMzEuODE5NSA0NS45ODcyIDMyLjY4OTcgNDYuNTAxNUMzNC41MjMxIDQ3LjYzOTEgMzYuMDQzIDQ4LjU4MjMgMzcuMjQ4NiA0OS43MTk2QzM3LjcxOTQgNTAuMjIzNyAzNy44MDE2IDUxLjExMjIgMzcuODY0MyA1MS40OTY0TDM4Ljg0NjggNTIuMzc4MkMzMy41ODcyIDYwLjMzMDggMzEuMTUzIDcwLjE1MzkgMzIuNTkxNSA4MC4xNjI3TDMxLjMwNzcgODAuNTM3OEMzMC45NjkzIDgwLjk3NjggMzAuNDkxMiA4MS42Njc2IDI5Ljk5MTEgODEuODczOEMyOC40MTM4IDgyLjM3MjkgMjYuNjM4NyA4Mi41NTYyIDI0LjQ5NTYgODIuNzgxOUMyMy40ODk0IDgyLjg2NiAyMi42MjEzIDgyLjgxNTggMjEuNTU0NiA4My4wMTg4QzIxLjMxOTggODMuMDYzNSAyMC45OTI3IDgzLjE0OTEgMjAuNzM1OCA4My4yMDk3QzIwLjcyNjkgODMuMjExNiAyMC43MTg2IDgzLjIxNDIgMjAuNzA5NiA4My4yMTYyQzIwLjY5NTYgODMuMjE5NSAyMC42NzcyIDgzLjIyNjMgMjAuNjYzOCA4My4yMjk0QzE4Ljg1NyA4My42NjggMTcuNjk2MyA4NS4zMzY1IDE4LjA2OTkgODYuOTgwNUMxOC40NDM3IDg4LjYyNDggMjAuMjA4NiA4OS42MjQ4IDIyLjAyNjIgODkuMjMxMkMyMi4wMzkzIDg5LjIyODIgMjIuMDU4NCA4OS4yMjc3IDIyLjA3MiA4OS4yMjQ2QzIyLjA5MjYgODkuMjE5OSAyMi4xMTA2IDg5LjIwOTkgMjIuMTMxIDg5LjIwNDlDMjIuMzg0NCA4OS4xNDkgMjIuNzAxOSA4OS4wODY4IDIyLjkyMzYgODkuMDI3MkMyMy45NzIzIDg4Ljc0NTEgMjQuNzMxOCA4OC4zMzA2IDI1LjY3NDYgODcuOTY3N0MyNy43MDI5IDg3LjIzNjggMjkuMzgyOCA4Ni42MjYyIDMxLjAxOTUgODYuMzg4M0MzMS43MDMgODYuMzM0NSAzMi40MjMyIDg2LjgxMiAzMi43ODE0IDg3LjAxMzRMMzQuMTE3NyA4Ni43ODMxQzM3LjE5MjYgOTYuMzYxMyA0My42MzY2IDEwNC4xMDMgNTEuNzk2MyAxMDguOTYxTDUxLjIzOTYgMTEwLjMwM0M1MS40NDAzIDExMC44MjQgNTEuNjYxNiAxMTEuNTMgNTEuNTEyMSAxMTIuMDQ1QzUwLjkxNzEgMTEzLjU5NSA0OS44OTggMTE1LjIzMSA0OC43Mzc0IDExNy4wNTVDNDguMTc1NSAxMTcuODk4IDQ3LjYwMDQgMTE4LjU1MiA0Ny4wOTM0IDExOS41MTZDNDYuOTcyIDExOS43NDcgNDYuODE3NSAxMjAuMTAyIDQ2LjcwMDQgMTIwLjM0NkM0NS45MTI1IDEyMi4wMzkgNDYuNDkwNCAxMjMuOTkgNDguMDAzOCAxMjQuNzIyQzQ5LjUyNjggMTI1LjQ1OSA1MS40MTcxIDEyNC42ODIgNTIuMjM1MiAxMjIuOTg1QzUyLjIzNjQgMTIyLjk4MiA1Mi4yNDA2IDEyMi45OCA1Mi4yNDE3IDEyMi45NzhDNTIuMjQyNiAxMjIuOTc2IDUyLjI0MDkgMTIyLjk3MyA1Mi4yNDE3IDEyMi45NzFDNTIuMzU4MiAxMjIuNzMxIDUyLjUyMzMgMTIyLjQxNSA1Mi42MjE2IDEyMi4xODhDNTMuMDU2IDEyMS4xODkgNTMuMjAwNSAxMjAuMzMyIDUzLjUwNTkgMTE5LjM2NUM1NC4zMTcgMTE3LjMxOCA1NC43NjI2IDExNS4xNyA1NS44NzkxIDExMy44MzJDNTYuMTg0OSAxMTMuNDY2IDU2LjY4MzMgMTEzLjMyNSA1Ny4yMDAxIDExMy4xODZMNTcuODk0NCAxMTEuOTIyQzY1LjAwOCAxMTQuNjY1IDcyLjk3MDUgMTE1LjQwMiA4MC45MjQ1IDExMy41ODdDODIuNzM5MSAxMTMuMTczIDg0LjQ5MDggMTEyLjYzNyA4Ni4xODQzIDExMS45OTRDODYuMzc5NCAxMTIuMzQyIDg2Ljc0MiAxMTMuMDExIDg2LjgzOTMgMTEzLjE3OUM4Ny4zNjQ0IDExMy4zNTEgODcuOTM3NyAxMTMuNDM5IDg4LjQwNDcgMTE0LjEzM0M4OS4yNDAxIDExNS41NjcgODkuODExNCAxMTcuMjYzIDkwLjUwNzMgMTE5LjMxMkM5MC44MTI4IDEyMC4yNzkgOTAuOTYzOCAxMjEuMTM2IDkxLjM5ODEgMTIyLjEzNkM5MS40OTcxIDEyMi4zNjMgOTEuNjYxNCAxMjIuNjg0IDkxLjc3OCAxMjIuOTI1QzkyLjU5NDQgMTI0LjYyOCA5NC40OTA3IDEyNS40MDcgOTYuMDE1OSAxMjQuNjY5Qzk3LjUyOTIgMTIzLjkzNyA5OC4xMDc3IDEyMS45ODYgOTcuMzE5NCAxMjAuMjkzQzk3LjIwMjMgMTIwLjA0OSA5Ny4wNDEyIDExOS42OTUgOTYuOTE5OCAxMTkuNDY0Qzk2LjQxMjcgMTE4LjQ5OSA5NS44Mzc3IDExNy44NTIgOTUuMjc1OCAxMTcuMDA5Qzk0LjExNTIgMTE1LjE4NSA5My4xNTI2IDExMy42NyA5Mi41NTc1IDExMi4xMkM5Mi4zMDg3IDExMS4zMiA5Mi41OTk1IDExMC44MjMgOTIuNzkzMyAxMTAuMzAzQzkyLjY3NzIgMTEwLjE3IDkyLjQyODggMTA5LjQxNCA5Mi4yODI0IDEwOS4wNTlDMTAwLjc2MiAxMDQuMDI5IDEwNy4wMTcgOTUuOTk4NSAxMDkuOTU1IDg2LjcyMzlDMTEwLjM1MSA4Ni43ODY1IDExMS4wNDEgODYuOTA5MSAxMTEuMjY1IDg2Ljk1NDJDMTExLjcyNiA4Ni42NDg3IDExMi4xNDkgODYuMjUwMSAxMTIuOTgxIDg2LjMxNTlDMTE0LjYxNyA4Ni41NTM3IDExNi4yOTcgODcuMTY0NSAxMTguMzI2IDg3Ljg5NTNDMTE5LjI2OCA4OC4yNTgxIDEyMC4wMjggODguNjc5MyAxMjEuMDc3IDg4Ljk2MTRDMTIxLjI5OCA4OS4wMjEgMTIxLjYxNiA4OS4wNzY2IDEyMS44NjkgODkuMTMyNUMxMjEuODg5IDg5LjEzNzUgMTIxLjkwOCA4OS4xNDc1IDEyMS45MjggODkuMTUyMkMxMjEuOTQyIDg5LjE1NTMgMTIxLjk2MSA4OS4xNTU4IDEyMS45NzQgODkuMTU4OEMxMjMuNzkyIDg5LjU1MiAxMjUuNTU3IDg4LjU1MjYgMTI1LjkzIDg2LjkwODFDMTI2LjMwMyA4NS4yNjQxIDEyNS4xNDMgODMuNTk1MiAxMjMuMzM2IDgzLjE1N0MxMjMuMDc0IDgzLjA5NyAxMjIuNzAxIDgyLjk5NSAxMjIuNDQ2IDgyLjk0NjVDMTIxLjM3OSA4Mi43NDM1IDEyMC41MTEgODIuNzkzNSAxMTkuNTA1IDgyLjcwOTVDMTE3LjM2MSA4Mi40ODM5IDExNS41ODYgODIuMzAwNCAxMTQuMDA5IDgxLjgwMTRDMTEzLjM2NiA4MS41NTA3IDExMi45MDggODAuNzgxOSAxMTIuNjg2IDgwLjQ2NTVMMTExLjQ0OCA4MC4xMDM1QzExMi4wOSA3NS40MzggMTExLjkxNyA3MC41ODI1IDExMC44MDYgNjUuNzI0M0MxMDkuNjg1IDYwLjgyMDggMTA3LjcwNCA1Ni4zMzYxIDEwNS4wNjIgNTIuMzg0OEMxMDUuMzc5IDUyLjA5NDggMTA1Ljk3OSA1MS41NjEyIDEwNi4xNDkgNTEuNDA0M0MxMDYuMTk5IDUwLjg1MTcgMTA2LjE1NiA1MC4yNzIyIDEwNi43MjUgNDkuNjYwM0MxMDcuOTMxIDQ4LjUyMyAxMDkuNDUxIDQ3LjU3OTkgMTExLjI4NCA0Ni40NDIzQzExMi4xNTQgNDUuOTI3OSAxMTIuOTU5IDQ1LjU5NjQgMTEzLjgzMiA0NC45NDg0QzExNC4wMyA0NC44MDE5IDExNC4yOTkgNDQuNTY5OSAxMTQuNTA3IDQ0LjQwMjJDMTE1Ljk3NyA0My4yMjM3IDExNi4zMTYgNDEuMTkxMSAxMTUuMjYgMzkuODYxNEMxMTQuMjA0IDM4LjUzMTcgMTEyLjE1OSAzOC40MDY1IDExMC42ODggMzkuNTg1QzExMC40NzkgMzkuNzUxNiAxMTAuMTk1IDM5Ljk2ODggMTEwLjAwNyA0MC4xMzEyQzEwOS4xODQgNDAuODQyNiAxMDguNjc2IDQxLjU0NTIgMTA3Ljk4MyA0Mi4yODMyQzEwNi40NzEgNDMuODI1OSAxMDUuMjIyIDQ1LjExMyAxMDMuODUgNDYuMDQwOUMxMDMuMjU1IDQ2LjM4ODUgMTAyLjM4NSA0Ni4yNjgyIDEwMS45OSA0Ni4yNDQ5TDEwMC44MjQgNDcuMDgwNkM5NC4xNzUzIDQwLjA3NjMgODUuMTIzNSAzNS41OTgyIDc1LjM3NjYgMzQuNzI4M0M3NS4zNDk0IDM0LjMxNzkgNzUuMzEzNyAzMy41NzYxIDc1LjMwNDYgMzMuMzUyOUM3NC45MDU2IDMyLjk2OTMgNzQuNDIzNSAzMi42NDE4IDc0LjMwMjQgMzEuODEzQzc0LjE2OTEgMzAuMTU2OSA3NC4zOTE3IDI4LjM3NTIgNzQuNjQ5NiAyNi4yMjU4Qzc0Ljc5MTkgMjUuMjIxNiA3NS4wMjg0IDI0LjM4NzMgNzUuMDY4OCAyMy4yOTczQzc1LjA3OCAyMy4wNDk1IDc1LjA2MzIgMjIuNjkgNzUuMDYyMiAyMi40MjIxQzc1LjA2MiAyMC41MzIyIDczLjY4OTggMTguOTk5OCA3MS45OTY4IDE5Wk02OC4xNTg1IDQyLjg4ODZMNjcuMjQ4IDU5LjA0NDdMNjcuMTgyNSA1OS4wNzc2QzY3LjEyMTQgNjAuNTIyOSA2NS45Mzc1IDYxLjY3NyA2NC40ODM5IDYxLjY3N0M2My44ODg0IDYxLjY3NyA2My4zMzg4IDYxLjQ4NDkgNjIuODkyMiA2MS4xNTcxTDYyLjg2NiA2MS4xNzAzTDQ5LjY4MDcgNTEuNzc5NEM1My43MzMxIDQ3Ljc3NTkgNTguOTE2NCA0NC44MTcyIDY0Ljg5IDQzLjQ1NDZDNjUuOTgxMiA0My4yMDU2IDY3LjA3MTkgNDMuMDIwOSA2OC4xNTg1IDQyLjg4ODZaTTc1Ljg0MTcgNDIuODg4NkM4Mi44MTU5IDQzLjc1MDQgODkuMjY1NyA0Ni45MjMyIDk0LjIwODEgNTEuNzg2TDgxLjEwOCA2MS4xMTc2TDgxLjA2MjEgNjEuMDk3OUM3OS44OTk0IDYxLjk1MTIgNzguMjYxMSA2MS43Mzk0IDc3LjM1NDggNjAuNTk3OEM3Ni45ODM1IDYwLjEzMDEgNzYuNzg4NyA1OS41ODAxIDc2Ljc2NTMgNTkuMDI0OUw3Ni43NTIyIDU5LjAxODRMNzUuODQxNyA0Mi44ODg2Wk00NC44OTkxIDU3LjgxNEw1Ni45MzgyIDY4LjYzM0w1Ni45MjUxIDY4LjY5ODhDNTguMDExNyA2OS42NDc5IDU4LjE3MiA3MS4yOTQ5IDU3LjI2NTcgNzIuNDM2OEM1Ni44OTQ0IDcyLjkwNDUgNTYuMzk3NSA3My4yMTgyIDU1Ljg2MzkgNzMuMzY0N0w1NS44NTA4IDczLjQxNzNMNDAuNDE4OCA3Ny44OTIzQzM5LjYzMzQgNzAuNjc2NSA0MS4zMjYxIDYzLjY2MjEgNDQuODk5MSA1Ny44MTRaTTk5LjAwOTQgNTcuODIwNkMxMDAuNzk4IDYwLjczMzYgMTAyLjE1MyA2My45ODcxIDEwMi45NTkgNjcuNTE0M0MxMDMuNzU2IDcwLjk5OTEgMTAzLjk1NiA3NC40Nzc4IDEwMy42MjcgNzcuODM5N0w4OC4xMTY2IDczLjM1MTVMODguMTAzNSA3My4yODU3Qzg2LjcxNDUgNzIuOTA0MyA4NS44NjA5IDcxLjQ4NDggODYuMTg0MyA3MC4wNjExQzg2LjMxNjggNjkuNDc3OCA4Ni42MjQ5IDY4Ljk4NDQgODcuMDQyMyA2OC42MTk4TDg3LjAzNTggNjguNTg2OUw5OS4wMDk0IDU3LjgyMDZaTTY5LjUyNzQgNjkuNDY4OEg3NC40NTk2TDc3LjUyNTEgNzMuMzE4Nkw3Ni40MjQ3IDc4LjEyMjZMNzEuOTk2OCA4MC4yNjE0TDY3LjU1NTggNzguMTE2MUw2Ni40NTU0IDczLjMxMkw2OS41Mjc0IDY5LjQ2ODhaTTg1LjMzOTMgODIuNjQzN0M4NS41NDg5IDgyLjYzMzEgODUuNzU3NiA4Mi42NTIgODUuOTYxNiA4Mi42ODk4TDg1Ljk4NzggODIuNjU2OUwxMDEuOTUgODUuMzY4MkM5OS42MTQyIDkxLjk2MjQgOTUuMTQ0IDk3LjY3NSA4OS4xNzExIDEwMS40OThMODIuOTc0NyA4Ni40NjA2TDgyLjk5NDQgODYuNDM0M0M4Mi40MjUyIDg1LjEwNTUgODIuOTk0OCA4My41NDcyIDg0LjMwNDQgODIuOTEzNUM4NC42Mzk3IDgyLjc1MTMgODQuOTkgODIuNjYxNCA4NS4zMzkzIDgyLjY0MzdaTTU4LjUyOTggODIuNzA5NUM1OS43NDggODIuNzI2NyA2MC44NDA2IDgzLjU3NjEgNjEuMTIzNyA4NC44MjJDNjEuMjU2MiA4NS40MDUyIDYxLjE5MTcgODUuOTgzMSA2MC45NzMgODYuNDkzNUw2MS4wMTg5IDg2LjU1MjdMNTQuODg4IDEwMS40MzlDNDkuMTU1OSA5Ny43NDMyIDQ0LjU5MDQgOTIuMjA5OSA0Mi4xNDgxIDg1LjQyMDhMNTcuOTczMSA4Mi43MjI3TDU3Ljk5OTMgODIuNzU1NkM1OC4xNzYzIDgyLjcyMjkgNTguMzU1OCA4Mi43MDcxIDU4LjUyOTggODIuNzA5NVpNNzEuODk4NiA4OS4yMzEyQzcyLjMyMjkgODkuMjE1NSA3Mi43NTM0IDg5LjMwMyA3My4xNjI3IDg5LjUwMUM3My42OTkyIDg5Ljc2MDYgNzQuMTEzNiA5MC4xNjkyIDc0LjM3NDUgOTAuNjU5Mkg3NC40MzM0TDgyLjIzNDYgMTA0LjgyMUM4MS4yMjIxIDEwNS4xNjIgODAuMTgxMyAxMDUuNDU0IDc5LjExNjcgMTA1LjY5N0M3My4xNTA1IDEwNy4wNTggNjcuMjAzMiAxMDYuNjQ1IDYxLjgxOCAxMDQuODAyTDY5LjU5OTUgOTAuNjY1OEg2OS42MTI2QzcwLjA3OTUgODkuNzg4OCA3MC45NjUgODkuMjY1NiA3MS44OTg2IDg5LjIzMTJaIiBmaWxsPSJ3aGl0ZSIgc3Ryb2tlPSJ3aGl0ZSIgc3Ryb2tlLXdpZHRoPSIwLjI1Ii8+CjxkZWZzPgo8bGluZWFyR3JhZGllbnQgaWQ9InBhaW50MF9saW5lYXJfNjgxXzI4NDUiIHgxPSIxMCIgeTE9IjE1LjUiIHgyPSIxNDQiIHkyPSIxMzEuNSIgZ3JhZGllbnRVbml0cz0idXNlclNwYWNlT25Vc2UiPgo8c3RvcCBzdG9wLWNvbG9yPSIjNEQ4N0ZGIi8+CjxzdG9wIG9mZnNldD0iMSIgc3RvcC1jb2xvcj0iIzA1NDdEMCIvPgo8L2xpbmVhckdyYWRpZW50Pgo8L2RlZnM+Cjwvc3ZnPgo=
-    keysOrder: [["apiVersion"], ["appVersion"], ["kind"], ["metadata"], ["metadata", "name"], ["spec", "storageClass"], ["spec", "nodeGroups"], ["spec", "nodeGroups", "md0"], ["spec", "nodeGroups", "md0", "minReplicas"], ["spec", "nodeGroups", "md0", "maxReplicas"], ["spec", "nodeGroups", "md0", "instanceType"], ["spec", "nodeGroups", "md0", "ephemeralStorage"], ["spec", "nodeGroups", "md0", "roles"], ["spec", "nodeGroups", "md0", "resources"], ["spec", "nodeGroups", "md0", "gpus"], ["spec", "version"], ["spec", "host"], ["spec", "addons"], ["spec", "addons", "certManager"], ["spec", "addons", "certManager", "enabled"], ["spec", "addons", "certManager", "valuesOverride"], ["spec", "addons", "cilium"], ["spec", "addons", "cilium", "valuesOverride"], ["spec", "addons", "gatewayAPI"], ["spec", "addons", "gatewayAPI", "enabled"], ["spec", "addons", "ingressNginx"], ["spec", "addons", "ingressNginx", "enabled"], ["spec", "addons", "ingressNginx", "exposeMethod"], ["spec", "addons", "ingressNginx", "hosts"], ["spec", "addons", "ingressNginx", "valuesOverride"], ["spec", "addons", "gpuOperator"], ["spec", "addons", "gpuOperator", "enabled"], ["spec", "addons", "gpuOperator", "valuesOverride"], ["spec", "addons", "hami"], ["spec", "addons", "hami", "enabled"], ["spec", "addons", "hami", "valuesOverride"], ["spec", "addons", "fluxcd"], ["spec", "addons", "fluxcd", "enabled"], ["spec", "addons", "fluxcd", "valuesOverride"], ["spec", "addons", "monitoringAgents"], ["spec", "addons", "monitoringAgents", "enabled"], ["spec", "addons", "monitoringAgents", "valuesOverride"], ["spec", "addons", "verticalPodAutoscaler"], ["spec", "addons", "verticalPodAutoscaler", "valuesOverride"], ["spec", "addons", "velero"], ["spec", "addons", "velero", "enabled"], ["spec", "addons", "velero", "valuesOverride"], ["spec", "addons", "coredns"], ["spec", "addons", "coredns", "valuesOverride"], ["spec", "controlPlane"], ["spec", "controlPlane", "replicas"], ["spec", "controlPlane", "apiServer"], ["spec", "controlPlane", "apiServer", "resources"], ["spec", "controlPlane", "apiServer", "resourcesPreset"], ["spec", "controlPlane", "controllerManager"], ["spec", "controlPlane", "controllerManager", "resources"], ["spec", "controlPlane", "controllerManager", "resourcesPreset"], ["spec", "controlPlane", "scheduler"], ["spec", "controlPlane", "scheduler", "resources"], ["spec", "controlPlane", "scheduler", "resourcesPreset"], ["spec", "controlPlane", "konnectivity"], ["spec", "controlPlane", "konnectivity", "server"], ["spec", "controlPlane", "konnectivity", "server", "resources"], ["spec", "controlPlane", "konnectivity", "server", "resourcesPreset"], ["spec", "images"], ["spec", "images", "waitForKubeconfig"]]
+    keysOrder: [["apiVersion"], ["appVersion"], ["kind"], ["metadata"], ["metadata", "name"], ["spec", "storageClass"], ["spec", "nodeGroups"], ["spec", "nodeGroups", "md0"], ["spec", "nodeGroups", "md0", "minReplicas"], ["spec", "nodeGroups", "md0", "maxReplicas"], ["spec", "nodeGroups", "md0", "instanceType"], ["spec", "nodeGroups", "md0", "ephemeralStorage"], ["spec", "nodeGroups", "md0", "roles"], ["spec", "nodeGroups", "md0", "resources"], ["spec", "nodeGroups", "md0", "gpus"], ["spec", "version"], ["spec", "host"], ["spec", "addons"], ["spec", "addons", "certManager"], ["spec", "addons", "certManager", "enabled"], ["spec", "addons", "certManager", "valuesOverride"], ["spec", "addons", "cilium"], ["spec", "addons", "cilium", "valuesOverride"], ["spec", "addons", "gatewayAPI"], ["spec", "addons", "gatewayAPI", "enabled"], ["spec", "addons", "ingressNginx"], ["spec", "addons", "ingressNginx", "enabled"], ["spec", "addons", "ingressNginx", "exposeMethod"], ["spec", "addons", "ingressNginx", "hosts"], ["spec", "addons", "ingressNginx", "valuesOverride"], ["spec", "addons", "gpuOperator"], ["spec", "addons", "gpuOperator", "enabled"], ["spec", "addons", "gpuOperator", "valuesOverride"], ["spec", "addons", "fluxcd"], ["spec", "addons", "fluxcd", "enabled"], ["spec", "addons", "fluxcd", "valuesOverride"], ["spec", "addons", "monitoringAgents"], ["spec", "addons", "monitoringAgents", "enabled"], ["spec", "addons", "monitoringAgents", "valuesOverride"], ["spec", "addons", "verticalPodAutoscaler"], ["spec", "addons", "verticalPodAutoscaler", "valuesOverride"], ["spec", "addons", "velero"], ["spec", "addons", "velero", "enabled"], ["spec", "addons", "velero", "valuesOverride"], ["spec", "addons", "coredns"], ["spec", "addons", "coredns", "valuesOverride"], ["spec", "controlPlane"], ["spec", "controlPlane", "replicas"], ["spec", "controlPlane", "apiServer"], ["spec", "controlPlane", "apiServer", "resources"], ["spec", "controlPlane", "apiServer", "resourcesPreset"], ["spec", "controlPlane", "controllerManager"], ["spec", "controlPlane", "controllerManager", "resources"], ["spec", "controlPlane", "controllerManager", "resourcesPreset"], ["spec", "controlPlane", "scheduler"], ["spec", "controlPlane", "scheduler", "resources"], ["spec", "controlPlane", "scheduler", "resourcesPreset"], ["spec", "controlPlane", "konnectivity"], ["spec", "controlPlane", "konnectivity", "server"], ["spec", "controlPlane", "konnectivity", "server", "resources"], ["spec", "controlPlane", "konnectivity", "server", "resourcesPreset"]]
   secrets:
     exclude: []
     include:
diff --git a/packages/system/lineage-controller-webhook/Makefile b/packages/system/lineage-controller-webhook/Makefile
index cdc1cf01..d5bada31 100644
--- a/packages/system/lineage-controller-webhook/Makefile
+++ b/packages/system/lineage-controller-webhook/Makefile
@@ -4,13 +4,8 @@ NAMESPACE=cozy-system
 include ../../../hack/common-envs.mk
 include ../../../hack/package.mk
 
-.PHONY: test
-
 image: image-lineage-controller-webhook
 
-test:
-	helm unittest .
-
 image-lineage-controller-webhook:
 	docker buildx build -f images/lineage-controller-webhook/Dockerfile ../../.. \
 		--tag $(REGISTRY)/lineage-controller-webhook:$(call settag,$(TAG)) \
diff --git a/packages/system/lineage-controller-webhook/README.md b/packages/system/lineage-controller-webhook/README.md
deleted file mode 100644
index 1e43c9c8..00000000
--- a/packages/system/lineage-controller-webhook/README.md
+++ /dev/null
@@ -1,67 +0,0 @@
-# lineage-controller-webhook
-
-Cozystack system package for the **lineage controller webhook** — a mutating
-admission webhook that stamps "lineage" labels onto tenant workloads, linking
-each resource back to the Cozystack `Application` that ultimately owns it.
-
-The webhook intercepts CREATE and UPDATE on `pods`, `secrets`, `services`,
-`persistentvolumeclaims`, `ingresses.networking.k8s.io`, and
-`workloadmonitors.cozystack.io` outside system namespaces. For each request it
-walks the ownership graph upward (Kubernetes `ownerReferences`, then the
-`HelmRelease` Flux installed the resource with, then the Cozystack
-`Application`-derived CRD that produced the HelmRelease) and writes the
-discovered application's group, kind and name as labels
-(`apps.cozystack.io/application.{group,kind,name}`) on the incoming object.
-Those labels let the aggregated API server, the Cozystack dashboard, and other
-lineage-aware consumers reason about which application a resource belongs to.
-
-The webhook serves TLS on port 9443 with a cert-manager issued certificate, and
-runs with `failurePolicy: Fail` — every CREATE/UPDATE on the resources above
-is gated on the webhook being reachable.
-
-## Topology
-
-The chart ships a single shape, modelled on `cozystack-api`:
-
-- **Deployment** with two replicas (override via `replicas`).
-- **Soft `nodeAffinity`** preferring `node-role.kubernetes.io/control-plane`
-  (`Exists`, so it matches both Talos's empty value and k3s/kubeadm's `"true"`).
-  Soft means: the pod lands on a control-plane node when one is reachable, and
-  on any worker otherwise — no override needed for managed Kubernetes,
-  Cozy-in-Cozy tenants, or any other cluster where control-plane nodes aren't
-  visible.
-- **Permissive `tolerations`** (`[{operator: Exists}]`) so the pod can land on
-  tainted control-plane nodes when the soft affinity is satisfiable.
-- **Soft `podAntiAffinity`** on `kubernetes.io/hostname` so replicas spread
-  across nodes when possible (best-effort).
-- **`PodDisruptionBudget`** with `maxUnavailable: 1`, unconditional. At
-  `replicas: 1` it's a useful no-op (allows full drain); at `replicas >= 2`
-  it caps disruption to one pod.
-- **`Service` with `spec.trafficDistribution: PreferClose`** so the apiserver
-  prefers a webhook endpoint on its own node when one exists, and transparently
-  falls over to a remote endpoint otherwise. Requires Kubernetes ≥ 1.31; on
-  older clusters the field is silently ignored and traffic uses default
-  cluster-wide distribution.
-
-## Parameters
-
-All keys live under the top-level `lineageControllerWebhook:` map.
-
-| Name                          | Description                                               | Value                                                                            |
-| ----------------------------- | --------------------------------------------------------- | -------------------------------------------------------------------------------- |
-| `image`                       | Container image (digest-pinned)                           | `ghcr.io/cozystack/cozystack/lineage-controller-webhook:v1.3.0@sha256:e898…6fb0` |
-| `debug`                       | Enable `--zap-log-level=debug` instead of `info`          | `false`                                                                          |
-| `replicas`                    | Deployment replica count                                  | `2`                                                                              |
-| `localK8sAPIEndpoint.enabled` | **Deprecated.** See note below.                           | `false`                                                                          |
-
-### `localK8sAPIEndpoint.enabled` (deprecated)
-
-When enabled, this injects `KUBERNETES_SERVICE_HOST=status.hostIP` and
-`KUBERNETES_SERVICE_PORT=6443` so the webhook talks to the kube-apiserver on
-its own node. It was originally added to avoid latency on the
-webhook-to-apiserver path, but it is only valid when the pod is actually
-scheduled on an apiserver-bearing node — which the chart's soft control-plane
-affinity no longer guarantees. With this flag enabled and the pod scheduled
-off a control-plane node, the controller will crash-loop dialing a non-
-apiserver hostIP. Slated for removal once the latency motivation is addressed
-in the webhook itself; **leave disabled**.
diff --git a/packages/system/lineage-controller-webhook/images/lineage-controller-webhook/Dockerfile b/packages/system/lineage-controller-webhook/images/lineage-controller-webhook/Dockerfile
index d9232d98..64d46ddb 100644
--- a/packages/system/lineage-controller-webhook/images/lineage-controller-webhook/Dockerfile
+++ b/packages/system/lineage-controller-webhook/images/lineage-controller-webhook/Dockerfile
@@ -1,4 +1,4 @@
-FROM golang:1.25-alpine AS builder
+FROM golang:1.26-alpine AS builder
 
 ARG TARGETOS
 ARG TARGETARCH
diff --git a/packages/system/lineage-controller-webhook/templates/workload.yaml b/packages/system/lineage-controller-webhook/templates/daemonset.yaml
similarity index 67%
rename from packages/system/lineage-controller-webhook/templates/workload.yaml
rename to packages/system/lineage-controller-webhook/templates/daemonset.yaml
index 097919c6..860aee6e 100644
--- a/packages/system/lineage-controller-webhook/templates/workload.yaml
+++ b/packages/system/lineage-controller-webhook/templates/daemonset.yaml
@@ -1,11 +1,10 @@
 apiVersion: apps/v1
-kind: Deployment
+kind: DaemonSet
 metadata:
   name: lineage-controller-webhook
   labels:
     app: lineage-controller-webhook
 spec:
-  replicas: {{ .Values.lineageControllerWebhook.replicas }}
   selector:
     matchLabels:
       app: lineage-controller-webhook
@@ -14,25 +13,13 @@ spec:
       labels:
         app: lineage-controller-webhook
     spec:
-      serviceAccountName: lineage-controller-webhook
+      {{- with .Values.lineageControllerWebhook.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       tolerations:
       - operator: Exists
-      affinity:
-        nodeAffinity:
-          preferredDuringSchedulingIgnoredDuringExecution:
-          - weight: 100
-            preference:
-              matchExpressions:
-              - key: node-role.kubernetes.io/control-plane
-                operator: Exists
-        podAntiAffinity:
-          preferredDuringSchedulingIgnoredDuringExecution:
-          - weight: 100
-            podAffinityTerm:
-              topologyKey: kubernetes.io/hostname
-              labelSelector:
-                matchLabels:
-                  app: lineage-controller-webhook
+      serviceAccountName: lineage-controller-webhook
       containers:
       - name: lineage-controller-webhook
         image: "{{ .Values.lineageControllerWebhook.image }}"
diff --git a/packages/system/lineage-controller-webhook/templates/pdb.yaml b/packages/system/lineage-controller-webhook/templates/pdb.yaml
deleted file mode 100644
index 0786c8ff..00000000
--- a/packages/system/lineage-controller-webhook/templates/pdb.yaml
+++ /dev/null
@@ -1,9 +0,0 @@
-apiVersion: policy/v1
-kind: PodDisruptionBudget
-metadata:
-  name: lineage-controller-webhook
-spec:
-  maxUnavailable: 1
-  selector:
-    matchLabels:
-      app: lineage-controller-webhook
diff --git a/packages/system/lineage-controller-webhook/templates/service.yaml b/packages/system/lineage-controller-webhook/templates/service.yaml
index fbb3ad54..c5df90fb 100644
--- a/packages/system/lineage-controller-webhook/templates/service.yaml
+++ b/packages/system/lineage-controller-webhook/templates/service.yaml
@@ -5,7 +5,7 @@ metadata:
   labels:
     app: lineage-controller-webhook
 spec:
-  trafficDistribution: PreferClose
+  internalTrafficPolicy: Local
   type: ClusterIP
   ports:
     - port: 443
diff --git a/packages/system/lineage-controller-webhook/tests/service_test.yaml b/packages/system/lineage-controller-webhook/tests/service_test.yaml
deleted file mode 100644
index 3cdbddd8..00000000
--- a/packages/system/lineage-controller-webhook/tests/service_test.yaml
+++ /dev/null
@@ -1,30 +0,0 @@
-suite: lineage-controller-webhook service
-templates:
-  - templates/service.yaml
-
-release:
-  name: lineage-controller-webhook
-  namespace: cozy-system
-
-tests:
-  - it: renders a ClusterIP service on 443 -> 9443 with PreferClose traffic distribution
-    asserts:
-      - isKind:
-          of: Service
-      - equal:
-          path: spec.type
-          value: ClusterIP
-      - equal:
-          path: spec.trafficDistribution
-          value: PreferClose
-      - notExists:
-          path: spec.internalTrafficPolicy
-      - equal:
-          path: spec.ports[0].port
-          value: 443
-      - equal:
-          path: spec.ports[0].targetPort
-          value: 9443
-      - equal:
-          path: spec.selector.app
-          value: lineage-controller-webhook
diff --git a/packages/system/lineage-controller-webhook/tests/workload_test.yaml b/packages/system/lineage-controller-webhook/tests/workload_test.yaml
deleted file mode 100644
index bcb24014..00000000
--- a/packages/system/lineage-controller-webhook/tests/workload_test.yaml
+++ /dev/null
@@ -1,99 +0,0 @@
-suite: lineage-controller-webhook workload + PDB
-templates:
-  - templates/workload.yaml
-  - templates/pdb.yaml
-
-release:
-  name: lineage-controller-webhook
-  namespace: cozy-system
-
-tests:
-  # ---- Default Deployment shape ----------------------------------------------
-
-  - it: defaults render a 2-replica Deployment with soft control-plane nodeAffinity, soft podAntiAffinity, and Exists tolerations
-    template: templates/workload.yaml
-    asserts:
-      - isKind:
-          of: Deployment
-      - equal:
-          path: spec.replicas
-          value: 2
-      - equal:
-          path: spec.template.spec.tolerations
-          value:
-            - operator: Exists
-      - equal:
-          path: spec.template.spec.affinity.nodeAffinity.preferredDuringSchedulingIgnoredDuringExecution
-          value:
-            - weight: 100
-              preference:
-                matchExpressions:
-                  - key: node-role.kubernetes.io/control-plane
-                    operator: Exists
-      - notExists:
-          path: spec.template.spec.affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution
-      - equal:
-          path: spec.template.spec.affinity.podAntiAffinity.preferredDuringSchedulingIgnoredDuringExecution[0].podAffinityTerm.topologyKey
-          value: kubernetes.io/hostname
-
-  - it: defaults inject no localK8sAPIEndpoint env vars (knob is opt-in)
-    template: templates/workload.yaml
-    asserts:
-      - notExists:
-          path: spec.template.spec.containers[0].env
-
-  # ---- PDB --------------------------------------------------------------------
-
-  - it: PDB renders unconditionally with maxUnavailable=1 at the default replica count
-    template: templates/pdb.yaml
-    asserts:
-      - isKind:
-          of: PodDisruptionBudget
-      - equal:
-          path: spec.maxUnavailable
-          value: 1
-      - notExists:
-          path: spec.minAvailable
-
-  - it: PDB still renders at replicas=1 (no-op, but consistent shape)
-    set:
-      lineageControllerWebhook.replicas: 1
-    template: templates/pdb.yaml
-    asserts:
-      - isKind:
-          of: PodDisruptionBudget
-      - equal:
-          path: spec.maxUnavailable
-          value: 1
-
-  # ---- Replica override -------------------------------------------------------
-
-  - it: replicas value drives spec.replicas
-    set:
-      lineageControllerWebhook.replicas: 5
-    template: templates/workload.yaml
-    asserts:
-      - equal:
-          path: spec.replicas
-          value: 5
-
-  # ---- Deprecated localK8sAPIEndpoint knob -----------------------------------
-
-  - it: localK8sAPIEndpoint.enabled=true injects KUBERNETES_SERVICE_HOST and PORT env vars
-    set:
-      lineageControllerWebhook.localK8sAPIEndpoint.enabled: true
-    template: templates/workload.yaml
-    asserts:
-      - contains:
-          path: spec.template.spec.containers[0].env
-          content:
-            name: KUBERNETES_SERVICE_HOST
-            valueFrom:
-              fieldRef:
-                apiVersion: v1
-                fieldPath: status.hostIP
-      - contains:
-          path: spec.template.spec.containers[0].env
-          content:
-            name: KUBERNETES_SERVICE_PORT
-            value: "6443"
diff --git a/packages/system/lineage-controller-webhook/values.yaml b/packages/system/lineage-controller-webhook/values.yaml
index e56d332d..c5671548 100644
--- a/packages/system/lineage-controller-webhook/values.yaml
+++ b/packages/system/lineage-controller-webhook/values.yaml
@@ -1,13 +1,10 @@
 lineageControllerWebhook:
   image: ghcr.io/cozystack/cozystack/lineage-controller-webhook:v1.3.0@sha256:e8984709686a5eaf19b89da378d7b8c688ea5607e0783a88d9c9e4ccfca96fb0
   debug: false
-  replicas: 2
-  # DEPRECATED. Injects KUBERNETES_SERVICE_HOST=status.hostIP and
-  # KUBERNETES_SERVICE_PORT=6443 so the webhook talks to the apiserver on its
-  # own node — only valid when the pod is actually scheduled on an apiserver-
-  # bearing node. Now that the chart's nodeAffinity to control-plane is soft
-  # (preferred, not required), the pod can land off-control-plane and crash-
-  # loop dialing a non-apiserver hostIP. Slated for removal once webhook
-  # performance work obviates the locality motivation. Leave disabled.
   localK8sAPIEndpoint:
-    enabled: false
+    enabled: true
+  # nodeSelector for the DaemonSet
+  # Talos uses empty value: "node-role.kubernetes.io/control-plane": ""
+  # Generic k8s (k3s, kubeadm) uses: "node-role.kubernetes.io/control-plane": "true"
+  nodeSelector:
+    node-role.kubernetes.io/control-plane: ""
diff --git a/packages/system/linstor-gui/Makefile b/packages/system/linstor-gui/Makefile
index b408491d..e202f4cc 100644
--- a/packages/system/linstor-gui/Makefile
+++ b/packages/system/linstor-gui/Makefile
@@ -12,13 +12,18 @@ image: image-linstor-gui
 
 image-linstor-gui:
 	docker buildx build images/linstor-gui \
+		--provenance false \
+		--builder=$(BUILDER) \
+		--platform=linux/amd64,linux/arm64 \
 		--build-arg LINSTOR_GUI_VERSION=$(LINSTOR_GUI_VERSION) \
 		--tag $(REGISTRY)/linstor-gui:$(call settag,$(LINSTOR_GUI_VERSION)) \
 		--tag $(REGISTRY)/linstor-gui:$(call settag,$(LINSTOR_GUI_VERSION)-$(TAG)) \
 		--cache-from type=registry,ref=$(REGISTRY)/linstor-gui:latest \
 		--cache-to type=inline \
 		--metadata-file images/linstor-gui.json \
-		$(BUILDX_ARGS)
+		--push=$(PUSH) \
+		--label "org.opencontainers.image.source=https://github.com/cozystack/cozystack" \
+		--load=$(LOAD)
 	REPOSITORY="$(REGISTRY)/linstor-gui" \
 		yq -i '.image.repository = strenv(REPOSITORY)' values.yaml
 	TAG="$(call settag,$(LINSTOR_GUI_VERSION))@$$(yq e '."containerimage.digest"' images/linstor-gui.json -o json -r)" \
diff --git a/packages/system/linstor/Makefile b/packages/system/linstor/Makefile
index 8d566678..2ad4def9 100644
--- a/packages/system/linstor/Makefile
+++ b/packages/system/linstor/Makefile
@@ -5,7 +5,7 @@ include ../../../hack/common-envs.mk
 include ../../../hack/package.mk
 
 LINSTOR_VERSION ?= 1.33.2
-LINSTOR_CSI_VERSION ?= v1.10.6
+LINSTOR_CSI_VERSION ?= v1.10.5
 
 image: image-piraeus-server image-linstor-csi
 
diff --git a/packages/system/linstor/images/linstor-csi/Dockerfile b/packages/system/linstor/images/linstor-csi/Dockerfile
index df5d179d..6cfd44aa 100644
--- a/packages/system/linstor/images/linstor-csi/Dockerfile
+++ b/packages/system/linstor/images/linstor-csi/Dockerfile
@@ -1,6 +1,6 @@
 FROM golang:1.25 AS builder
 
-ARG VERSION=v1.10.6
+ARG VERSION=v1.10.5
 ARG LINSTOR_WAIT_UNTIL_VERSION=v0.3.1
 ARG TARGETARCH
 ARG TARGETOS
diff --git a/packages/system/linstor/images/linstor-csi/patches/001-relocate-after-clone-restore.diff b/packages/system/linstor/images/linstor-csi/patches/001-relocate-after-clone-restore.diff
index 0e272670..ff0aec0c 100644
--- a/packages/system/linstor/images/linstor-csi/patches/001-relocate-after-clone-restore.diff
+++ b/packages/system/linstor/images/linstor-csi/patches/001-relocate-after-clone-restore.diff
@@ -1,7 +1,25 @@
 diff --git a/pkg/client/linstor.go b/pkg/client/linstor.go
-index ac4651d..46d565d 100644
+index f544493..98e7fde 100644
 --- a/pkg/client/linstor.go
 +++ b/pkg/client/linstor.go
+@@ -181,7 +181,7 @@ func LogLevel(s string) func(*Linstor) error {
+ func (s *Linstor) ListAllWithStatus(ctx context.Context) ([]volume.VolumeStatus, error) {
+ 	var vols []volume.VolumeStatus
+ 
+-	resourcesByName := make(map[string][]lapi.Resource)
++	resourcesByName := make(map[string][]lapi.ResourceWithVolumes)
+ 
+ 	resDefs, err := s.client.ResourceDefinitions.GetAll(ctx, lapi.RDGetAllRequest{WithVolumeDefinitions: true})
+ 	if err != nil {
+@@ -194,7 +194,7 @@ func (s *Linstor) ListAllWithStatus(ctx context.Context) ([]volume.VolumeStatus,
+ 	}
+ 
+ 	for i := range allResources {
+-		resourcesByName[allResources[i].Name] = append(resourcesByName[allResources[i].Name], allResources[i].Resource)
++		resourcesByName[allResources[i].Name] = append(resourcesByName[allResources[i].Name], allResources[i])
+ 	}
+ 
+ 	for _, rd := range resDefs {
 @@ -462,6 +462,14 @@ func (s *Linstor) Clone(ctx context.Context, vol, src *volume.Info, params *volu
  		return err
  	}
@@ -17,7 +35,7 @@ index ac4651d..46d565d 100644
  	logger.Debug("reconcile extra properties")
  
  	err = s.client.ResourceDefinitions.Modify(ctx, vol.ID, lapi.GenericPropsModify{OverrideProps: vol.Properties})
-@@ -1297,6 +1305,14 @@ func (s *Linstor) VolFromSnap(ctx context.Context, snap *volume.Snapshot, vol *v
+@@ -1280,6 +1288,14 @@ func (s *Linstor) VolFromSnap(ctx context.Context, snap *volume.Snapshot, vol *v
  		return err
  	}
  
@@ -32,7 +50,7 @@ index ac4651d..46d565d 100644
  	logger.Debug("reconcile extra properties")
  
  	err = s.client.ResourceDefinitions.Modify(ctx, vol.ID, lapi.GenericPropsModify{OverrideProps: vol.Properties})
-@@ -1487,9 +1503,8 @@ func (s *Linstor) reconcileSnapshotResources(ctx context.Context, snapshot *volu
+@@ -1470,9 +1486,8 @@ func (s *Linstor) reconcileSnapshotResources(ctx context.Context, snapshot *volu
  		return fmt.Errorf("snapshot '%s' not deployed on any node", snap.Name)
  	}
  
@@ -44,7 +62,7 @@ index ac4651d..46d565d 100644
  	for _, snapNode := range snap.Nodes {
  		if err := s.NodeAvailable(ctx, snapNode); err != nil {
  			logger.WithField("selected node candidate", snapNode).WithError(err).Debug("node is not available")
-@@ -1497,13 +1512,23 @@ func (s *Linstor) reconcileSnapshotResources(ctx context.Context, snapshot *volu
+@@ -1480,13 +1495,23 @@ func (s *Linstor) reconcileSnapshotResources(ctx context.Context, snapshot *volu
  		}
  
  		if slices.Contains(preferredNodes, snapNode) {
@@ -74,7 +92,7 @@ index ac4651d..46d565d 100644
  	}
  
  	if selectedNode == "" {
-@@ -1696,6 +1721,114 @@ func (s *Linstor) reconcileResourcePlacement(ctx context.Context, vol *volume.In
+@@ -1679,6 +1704,114 @@ func (s *Linstor) reconcileResourcePlacement(ctx context.Context, vol *volume.In
  	return nil
  }
  
@@ -189,8 +207,40 @@ index ac4651d..46d565d 100644
  // FindSnapsByID searches the snapshot in the backend
  func (s *Linstor) FindSnapsByID(ctx context.Context, id string) ([]*volume.Snapshot, error) {
  	snapshotId, err := volume.ParseSnapshotId(id)
+@@ -2173,7 +2306,7 @@ func (s *Linstor) Status(ctx context.Context, volId string) ([]string, *csi.Volu
+ 		"volume": volId,
+ 	}).Debug("getting assignments")
+ 
+-	ress, err := s.client.Resources.GetAll(ctx, volId)
++	ress, err := s.client.Resources.GetResourceView(ctx, &lapi.ListOpts{Resource: []string{volId}})
+ 	if err != nil {
+ 		return nil, nil, fmt.Errorf("failed to list resources for '%s': %w", volId, err)
+ 	}
+@@ -2261,13 +2394,20 @@ func GetSnapshotRemoteAndReadiness(snap *lapi.Snapshot) (string, bool, error) {
+ 	return "", slices.Contains(snap.Flags, lapiconsts.FlagSuccessful), nil
+ }
+ 
+-func NodesAndConditionFromResources(ress []lapi.Resource) ([]string, *csi.VolumeCondition) {
++func NodesAndConditionFromResources(ress []lapi.ResourceWithVolumes) ([]string, *csi.VolumeCondition) {
+ 	var allNodes, abnormalNodes []string
+ 
+ 	for i := range ress {
+ 		res := &ress[i]
+ 
+-		allNodes = append(allNodes, res.NodeName)
++		// A resource is a CSI publish target if any of its volumes were created
++		// by ControllerPublishVolume, identified by the temporary-diskless-attach property.
++		if slices.ContainsFunc(res.Volumes, func(v lapi.Volume) bool {
++			createdFor, ok := v.Props[linstor.PropertyCreatedFor]
++			return ok && createdFor == linstor.CreatedForTemporaryDisklessAttach
++		}) {
++			allNodes = append(allNodes, res.NodeName)
++		}
+ 
+ 		if res.State == nil {
+ 			abnormalNodes = append(abnormalNodes, res.NodeName)
 diff --git a/pkg/volume/parameter.go b/pkg/volume/parameter.go
-index 39acd95..54d1dfb 100644
+index 39acd95..aed18ab 100644
 --- a/pkg/volume/parameter.go
 +++ b/pkg/volume/parameter.go
 @@ -50,6 +50,7 @@ const (
diff --git a/packages/system/linstor/images/linstor-csi/patches/002-protocol-c-override-for-dual-attach.diff b/packages/system/linstor/images/linstor-csi/patches/002-protocol-c-override-for-dual-attach.diff
deleted file mode 100644
index 279c636b..00000000
--- a/packages/system/linstor/images/linstor-csi/patches/002-protocol-c-override-for-dual-attach.diff
+++ /dev/null
@@ -1,132 +0,0 @@
-diff --git a/pkg/client/linstor.go b/pkg/client/linstor.go
-index ac4651d..9d75c79 100644
---- a/pkg/client/linstor.go
-+++ b/pkg/client/linstor.go
-@@ -653,11 +653,35 @@ func (s *Linstor) Attach(ctx context.Context, volId, node string, rwxBlock bool)
- 	}
- 
- 	if otherResInUse > 0 && rwxBlock {
--		rdPropsModify := lapi.GenericPropsModify{OverrideProps: map[string]string{
-+		rdProps := map[string]string{
- 			linstor.PropertyAllowTwoPrimaries: "yes",
--		}}
-+		}
- 
--		err = s.client.ResourceDefinitions.Modify(ctx, volId, rdPropsModify)
-+		// DRBD requires Protocol C whenever allow-two-primaries is enabled.
-+		// If the resource is configured with Protocol A or B (typically
-+		// through its resource-group), drbdadm adjust on the satellites
-+		// fails with "Protocol C required" (errno 139) and live migration
-+		// cannot proceed. Override Protocol to C on the resource-definition
-+		// itself so it applies to every connection (including diskless
-+		// peers, e.g. a TieBreaker). The marker lets Detach revert exactly
-+		// the override we installed without disturbing operator-set props.
-+		proto, protoErr := s.getEffectiveDrbdProtocol(ctx, volId)
-+		if protoErr != nil {
-+			s.log.WithError(protoErr).WithField("volume", volId).
-+				Warn("failed to determine effective DRBD protocol; skipping Protocol=C override for dual-attach")
-+		} else if proto == "A" || proto == "B" {
-+			s.log.WithFields(logrus.Fields{
-+				"volume":   volId,
-+				"protocol": proto,
-+			}).Info("installing Protocol=C override on resource-definition for dual-attach")
-+
-+			rdProps[linstor.PropertyDrbdNetProtocol] = "C"
-+			rdProps[linstor.PropertyCsiProtocolOverride] = "yes"
-+		}
-+
-+		err = s.client.ResourceDefinitions.Modify(ctx, volId, lapi.GenericPropsModify{
-+			OverrideProps: rdProps,
-+		})
- 		if err != nil {
- 			return "", err
- 		}
-@@ -774,11 +798,26 @@ func (s *Linstor) Detach(ctx context.Context, volId, node string) error {
- 	}
- 
- 	if resInUse == 1 {
--		rdPropsModify := lapi.GenericPropsModify{DeleteProps: []string{
--			linstor.PropertyAllowTwoPrimaries,
--		}}
-+		deleteProps := []string{linstor.PropertyAllowTwoPrimaries}
-+
-+		// Drop the Protocol=C override only if Attach installed it (gated by
-+		// our marker), so an operator-set Protocol property on the
-+		// resource-definition is preserved.
-+		rd, getErr := s.client.ResourceDefinitions.Get(ctx, volId)
-+		if getErr != nil {
-+			log.WithError(getErr).Warn("failed to fetch resource-definition props; skipping Protocol=C override removal")
-+		} else if rd.Props[linstor.PropertyCsiProtocolOverride] != "" {
-+			log.Info("removing Protocol=C override from resource-definition")
- 
--		err = s.client.ResourceDefinitions.Modify(ctx, volId, rdPropsModify)
-+			deleteProps = append(deleteProps,
-+				linstor.PropertyDrbdNetProtocol,
-+				linstor.PropertyCsiProtocolOverride,
-+			)
-+		}
-+
-+		err = s.client.ResourceDefinitions.Modify(ctx, volId, lapi.GenericPropsModify{
-+			DeleteProps: deleteProps,
-+		})
- 		if err != nil {
- 			return nil404(err)
- 		}
-@@ -805,6 +844,33 @@ func (s *Linstor) Detach(ctx context.Context, volId, node string) error {
- 	return nil404(s.client.Resources.Delete(ctx, volId, node))
- }
- 
-+// getEffectiveDrbdProtocol returns the DRBD network protocol ("A", "B" or "C")
-+// that LINSTOR will hand to drbdadm for the given resource. Resource-definition
-+// properties take precedence; otherwise the value is inherited from the
-+// resource-group. An empty string is returned when neither level sets the
-+// property (LINSTOR's compiled-in default is "C").
-+func (s *Linstor) getEffectiveDrbdProtocol(ctx context.Context, volId string) (string, error) {
-+	rd, err := s.client.ResourceDefinitions.Get(ctx, volId)
-+	if err != nil {
-+		return "", err
-+	}
-+
-+	if v, ok := rd.Props[linstor.PropertyDrbdNetProtocol]; ok {
-+		return v, nil
-+	}
-+
-+	if rd.ResourceGroupName == "" {
-+		return "", nil
-+	}
-+
-+	rg, err := s.client.ResourceGroups.Get(ctx, rd.ResourceGroupName)
-+	if err != nil {
-+		return "", err
-+	}
-+
-+	return rg.Props[linstor.PropertyDrbdNetProtocol], nil
-+}
-+
- // CapacityBytes returns the amount of free space in the storage pool specified by the params and topology.
- func (s *Linstor) CapacityBytes(ctx context.Context, storagePools []string, overProvision *float64, segments map[string]string) (int64, error) {
- 	log := s.log.WithField("storage-pools", storagePools).WithField("segments", segments)
-diff --git a/pkg/linstor/const.go b/pkg/linstor/const.go
-index 9a5f79c..c8bc9c3 100644
---- a/pkg/linstor/const.go
-+++ b/pkg/linstor/const.go
-@@ -44,6 +44,19 @@ const (
- 	// PropertyAllowTwoPrimaries is DRBD option to allow second primary. Mainly used for live-migration.
- 	PropertyAllowTwoPrimaries = lc.NamespcDrbdNetOptions + "/allow-two-primaries"
- 
-+	// PropertyDrbdNetProtocol is the DRBD network replication protocol option
-+	// (A = async, B = semi-sync, C = sync). DRBD requires Protocol C whenever
-+	// allow-two-primaries is enabled, otherwise drbdadm adjust fails with
-+	// "Protocol C required" (errno 139).
-+	PropertyDrbdNetProtocol = lc.NamespcDrbdNetOptions + "/protocol"
-+
-+	// PropertyCsiProtocolOverride marks a resource-connection where this driver
-+	// has installed a temporary Protocol=C override to make a Protocol-A/B
-+	// resource compatible with allow-two-primaries during live migration. The
-+	// marker lets us safely remove only the overrides we set, without touching
-+	// connection-level overrides installed by the operator.
-+	PropertyCsiProtocolOverride = lc.NamespcAuxiliary + "/csi-protocol-override"
-+
- 	// CreatedForTemporaryDisklessAttach marks a resource as temporary, i.e. it should be removed after it is no longer
- 	// needed.
- 	CreatedForTemporaryDisklessAttach = "temporary-diskless-attach"
diff --git a/packages/system/monitoring-agents/alerts/gpu-recording.rules.yaml b/packages/system/monitoring-agents/alerts/gpu-recording.rules.yaml
deleted file mode 100644
index 5e0f9ea0..00000000
--- a/packages/system/monitoring-agents/alerts/gpu-recording.rules.yaml
+++ /dev/null
@@ -1,172 +0,0 @@
-apiVersion: operator.victoriametrics.com/v1beta1
-kind: VMRule
-metadata:
-  name: alerts-gpu-recording.rules
-spec:
-  groups:
-    - name: gpu.recording.cluster.1m
-      interval: 1m
-      params: {}
-      rules:
-        - record: cluster:gpu_count:total
-          expr: count(group by (UUID) (DCGM_FI_DEV_GPU_UTIL))
-        # Kube-allocated GPU count: GPUs requested by *active* pods — Pending
-        # and Running only. Source of truth for "what tenants asked for" — used
-        # for capacity planning and billing. Includes system pods so it stays
-        # consistent with cluster:gpu_count:total when computing :free.
-        #
-        # Phase filter via group_left() on kube_pod_status_phase matches the
-        # canonical pattern from k8s.rules.container_resource.yaml. Without it
-        # kube-state-metrics keeps series for Failed/Succeeded pods until the
-        # apiserver garbage-collects them, which inflates billing hours and
-        # can push :free negative.
-        - record: cluster:gpu_count:allocated
-          expr: |
-            sum(
-              kube_pod_container_resource_requests{resource="nvidia_com_gpu"}
-              * on (namespace, pod) group_left() max by (namespace, pod) (
-                kube_pod_status_phase{phase=~"Pending|Running"} == 1
-              )
-            )
-        # clamp_min guards against transients at DCGM/kube-state-metrics
-        # restart where cluster:gpu_count:total dips before :allocated catches
-        # up, or rare label drift between the two sources.
-        - record: cluster:gpu_count:free
-          expr: clamp_min(cluster:gpu_count:total - (cluster:gpu_count:allocated or vector(0)), 0)
-        # Cluster-layer filter asymmetry — intentional, not a bug:
-        #
-        #   * cluster:gpu_count:total and cluster:gpu_power_watts:sum do NOT
-        #     filter cozy-*/kube-* namespaces because they describe the
-        #     physical hardware fleet. A GPU draws power and occupies a
-        #     slot regardless of which namespace's pod happens to hold it;
-        #     excluding infra pods would under-report raw capacity and
-        #     break capacity-planning math.
-        #
-        # No namespace filter — DCGM exporter metrics carry the exporter's
-        # own namespace, not the workload namespace. Filtering by namespace
-        # here would silently drop all series.
-        - record: cluster:gpu_util:avg
-          expr: avg(DCGM_FI_DEV_GPU_UTIL)
-        - record: cluster:gpu_power_watts:sum
-          expr: sum(DCGM_FI_DEV_POWER_USAGE)
-
-    - name: gpu.recording.node.1m
-      interval: 1m
-      params: {}
-      rules:
-        # Kube-requested GPU count per namespace — billable/allocation view.
-        # This is the only namespace-level rule that works correctly because
-        # kube_pod_container_resource_requests carries the real workload
-        # namespace, unlike DCGM exporter metrics which carry the exporter's
-        # own namespace (cozy-gpu-operator).
-        - record: namespace:gpu_count:allocated
-          expr: |
-            sum by (namespace) (
-              kube_pod_container_resource_requests{resource="nvidia_com_gpu", namespace!="", namespace!~"cozy-.*|kube-.*"}
-              * on (namespace, pod) group_left() max by (namespace, pod) (
-                kube_pod_status_phase{phase=~"Pending|Running"} == 1
-              )
-            )
-        # Hardware metrics aggregated per node (Hostname). DCGM exporter
-        # metrics carry a capital-H "Hostname" label identifying the node
-        # but no usable workload namespace — so hardware telemetry is
-        # aggregated at node/GPU granularity, not namespace.
-        - record: node:gpu_util:avg
-          expr: avg by (Hostname) (DCGM_FI_DEV_GPU_UTIL)
-        - record: node:tensor_active:avg
-          expr: avg by (Hostname) (DCGM_FI_PROF_PIPE_TENSOR_ACTIVE)
-        - record: node:fb_used_bytes:sum
-          expr: sum by (Hostname) (DCGM_FI_DEV_FB_USED) * 1048576
-        - record: node:power_watts:sum
-          expr: sum by (Hostname) (DCGM_FI_DEV_POWER_USAGE)
-
-    # Known gap: there is no lower-bound sanity alert for under-reporting.
-    # If DCGM ever switches POWER/THERMAL_VIOLATION counter units the other
-    # direction — e.g. from the current nanoseconds back to microseconds,
-    # making rate()/1e9 produce values around 0.001 instead of real
-    # fractions — the throttle signal would silently collapse to near-zero
-    # instead of plateauing at 1.0. GPUThrottleFractionOverOne below catches
-    # the >1 drift; the <<1 drift would require correlation with independent
-    # signals (power draw vs TDP, clock dips) that we do not yet wire up.
-    # Documented here so future maintainers know this is a known gap, not
-    # an oversight.
-    - name: gpu.recording.efficiency.1m
-      interval: 1m
-      params: {}
-      rules:
-        # Tensor hardware saturation per GPU — the honest "am I using the GPU"
-        # metric for AI/LLM workloads. Aggregated at GPU level (Hostname +
-        # gpu + UUID) because DCGM metrics don't carry workload namespace.
-        # Stored as a 0..1 ratio; consumers multiply by 100 at display time.
-        - record: gpu:tensor_saturation:avg5m
-          expr: |
-            avg by (Hostname, gpu, UUID) (
-              avg_over_time(DCGM_FI_PROF_PIPE_TENSOR_ACTIVE[5m])
-            )
-
-        # Power efficiency per GPU — utilization per watt, reveals
-        # unoptimized workloads. Explicit on(...) pins the matching set
-        # to GPU-identifying labels.
-        - record: gpu:util_per_watt:avg5m
-          expr: |
-            max by (Hostname, gpu, UUID) (
-              avg_over_time(DCGM_FI_DEV_GPU_UTIL[5m])
-            )
-            / on (Hostname, gpu, UUID)
-            clamp_min(
-              max by (Hostname, gpu, UUID) (
-                avg_over_time(DCGM_FI_DEV_POWER_USAGE[5m])
-              ),
-              1
-            )
-
-        # Fraction of time power-throttled (TDP cap) — 1.0 = fully throttled.
-        # DCGM_FI_DEV_*_VIOLATION is documented as µs but on A10/DCGM 3.x the
-        # counter grows in nanoseconds in practice — divide by 1e9 to get a
-        # 0..1 fraction (verified empirically when /1e6 yielded >100× reality).
-        # clamp_max protects against rate() artefacts at counter resets.
-        #
-        # max by (Hostname, gpu, UUID) collapses duplicate series from
-        # dcgm-exporter's pod-mapping labels (one physical GPU may appear
-        # under multiple pod/container labels during restarts or under
-        # MIG/MPS). Throttling is a physical-GPU property; taking max
-        # keeps consumer avg(...) honest — a naive avg() would dilute the
-        # signal by the number of pods sharing the GPU.
-        - record: gpu:power_throttle_fraction:rate5m
-          expr: clamp_max(max by (Hostname, gpu, UUID) (rate(DCGM_FI_DEV_POWER_VIOLATION[5m]) / 1e9), 1)
-
-        # Fraction of time thermal-throttled.
-        - record: gpu:thermal_throttle_fraction:rate5m
-          expr: clamp_max(max by (Hostname, gpu, UUID) (rate(DCGM_FI_DEV_THERMAL_VIOLATION[5m]) / 1e9), 1)
-
-    # Regression watch — the /1e9 divisor on *_VIOLATION was derived
-    # empirically against DCGM 3.x on A10. If a future DCGM version
-    # restores the documented µs units, pre-clamp values would exceed 1.0
-    # while clamp_max(..., 1) silently masks the drift — recorded
-    # throttle fractions would plateau at 1.0 and consumers would think
-    # every GPU is always throttled. This alert fires on that condition
-    # so we can rescale to /1e6 before dashboards start lying.
-    - name: gpu.recording.throttle.validation.5m
-      interval: 5m
-      params: {}
-      rules:
-        - alert: GPUThrottleFractionOverOne
-          expr: |
-            max by (Hostname, gpu, UUID) (rate(DCGM_FI_DEV_POWER_VIOLATION[5m]) / 1e9) > 1
-            or
-            max by (Hostname, gpu, UUID) (rate(DCGM_FI_DEV_THERMAL_VIOLATION[5m]) / 1e9) > 1
-          for: 15m
-          labels:
-            severity: warning
-            component: gpu-monitoring
-          annotations:
-            summary: "DCGM throttle fraction exceeds 1.0 pre-clamp on {{ $labels.Hostname }}/{{ $labels.gpu }}"
-            description: |
-              gpu:{power,thermal}_throttle_fraction:rate5m clamps to 1.0, but the raw
-              rate(DCGM_FI_DEV_*_VIOLATION)/1e9 value is already >1 on this GPU — the
-              empirical nanosecond assumption is broken. Likely the DCGM exporter
-              version changed and the counter now grows in its documented µs units.
-              Re-verify on the exporter Pod and adjust the divisor (/1e9 → /1e6) in
-              gpu.recording.efficiency.1m before dashboards plateau at 100% throttle.
-            verified_on: "NVIDIA A10, DCGM 3.x — other GPU families (H100, L40S) may require a different divisor"
-            runbook: "If this alert fires, DCGM may have changed POWER_VIOLATION/THERMAL_VIOLATION counter units. Recalibrate by comparing raw counter rate against known throttle events; see gpu-recording.rules.yaml comments."
diff --git a/packages/system/monitoring/dashboards-infra.list b/packages/system/monitoring/dashboards-infra.list
index 4c7e494d..b5b9f52a 100644
--- a/packages/system/monitoring/dashboards-infra.list
+++ b/packages/system/monitoring/dashboards-infra.list
@@ -32,8 +32,3 @@ hubble/overview
 hubble/dns-namespace
 hubble/l7-http-metrics
 hubble/network-overview
-gpu/gpu-performance
-gpu/gpu-efficiency
-gpu/gpu-quotas
-gpu/gpu-fleet
-gpu/gpu-tenants
diff --git a/packages/system/postgres-operator/Makefile b/packages/system/postgres-operator/Makefile
index 5279f8a7..f6d7ddaa 100644
--- a/packages/system/postgres-operator/Makefile
+++ b/packages/system/postgres-operator/Makefile
@@ -3,9 +3,6 @@ export NAMESPACE=cozy-$(NAME)
 
 include ../../../hack/package.mk
 
-test:
-	helm unittest .
-
 update:
 	rm -rf charts
 	helm repo add cnpg https://cloudnative-pg.github.io/charts
diff --git a/packages/system/postgres-operator/templates/webhook-ready-hook.yaml b/packages/system/postgres-operator/templates/webhook-ready-hook.yaml
deleted file mode 100644
index 51a8ba81..00000000
--- a/packages/system/postgres-operator/templates/webhook-ready-hook.yaml
+++ /dev/null
@@ -1,148 +0,0 @@
-{{- /*
-  Post-install gate: block the HelmRelease from reporting Ready until the
-  cnpg admission webhook actually serves through the cluster Service. Helm
-  --wait on the controller pod passes once its readinessProbe passes, but
-  EndpointSlice propagation and kube-proxy/cilium data-plane programming
-  can lag by a second or two — long enough for any HelmRelease that
-  depends on postgres-operator (e.g. cozy-keycloak, tenant Postgres apps)
-  to fire its own install and have kube-apiserver hit the mcluster.cnpg.io
-  mutating webhook with "dial tcp <svc-ip>:443: connect: connection refused".
-
-  The Job uses the apiserver service proxy, which exercises the same
-  endpoint-resolution and apiserver-initiated pod dial that the admission
-  webhook path uses. Once /readyz answers through the proxy the data-plane
-  race is resolved. It does not verify the webhook's TLS CA bundle, so
-  this gate is scoped to reachability regressions, not cert rotation.
-
-  The service name and port name are hardcoded literals. Upstream cnpg
-  pins the service name in charts/cloudnative-pg/values.yaml with a
-  comment "DO NOT CHANGE THE SERVICE NAME as it is currently used to
-  generate the certificate and can not be configured". The port name is
-  fixed in charts/cloudnative-pg/templates/service.yaml (ports[0].name:
-  webhook-server). If a future `make update` ever changes either literal
-  upstream, the sync-check helm-unittest test
-  (tests/webhook-ready-hook_test.yaml) renders the subchart Service and
-  fails if the literal drifts — forcing this template to be updated in
-  the same change.
-*/}}
-{{- $_ := required "webhookReady.image.repository must be set to the container image providing kubectl for the post-install readiness Job" .Values.webhookReady.image.repository -}}
-{{- $_ := required "webhookReady.image.tag must be set for the post-install readiness Job" .Values.webhookReady.image.tag -}}
-{{- /* $svcName and $portName are hardcoded literals; see header comment. */ -}}
-{{- $svcName := "cnpg-webhook-service" -}}
-{{- /* $portName is the service port NAME, not number — matches ports[0].name in the vendored subchart's Service. */ -}}
-{{- $portName := "webhook-server" -}}
-{{- $resourceName := printf "https:%s:%s" $svcName $portName -}}
-{{- $maxAttempts := .Values.webhookReady.maxAttempts | default 60 -}}
-{{- $sleepSeconds := .Values.webhookReady.sleepSeconds | default 2 -}}
-{{- /* Derive activeDeadlineSeconds from retries + 60s slack so a values override that raises maxAttempts doesn't get silently cut. */ -}}
-{{- $deadline := add (mul (int $maxAttempts) (int $sleepSeconds)) 60 -}}
-{{- $image := printf "%s:%s" .Values.webhookReady.image.repository .Values.webhookReady.image.tag -}}
-{{- if .Values.webhookReady.image.digest }}
-{{- $image = printf "%s@%s" $image .Values.webhookReady.image.digest -}}
-{{- end }}
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: {{ .Release.Name }}-webhook-ready
-  namespace: {{ .Release.Namespace }}
-  annotations:
-    helm.sh/hook: post-install,post-upgrade
-    helm.sh/hook-weight: "0"
-    helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: {{ .Release.Name }}-webhook-ready
-  namespace: {{ .Release.Namespace }}
-  annotations:
-    helm.sh/hook: post-install,post-upgrade
-    helm.sh/hook-weight: "0"
-    helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
-rules:
-  - apiGroups: [""]
-    resources: ["services/proxy"]
-    resourceNames: [{{ $resourceName | quote }}]
-    verbs: ["get"]
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: {{ .Release.Name }}-webhook-ready
-  namespace: {{ .Release.Namespace }}
-  annotations:
-    helm.sh/hook: post-install,post-upgrade
-    helm.sh/hook-weight: "0"
-    helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: {{ .Release.Name }}-webhook-ready
-subjects:
-  - kind: ServiceAccount
-    name: {{ .Release.Name }}-webhook-ready
-    namespace: {{ .Release.Namespace }}
----
-apiVersion: batch/v1
-kind: Job
-metadata:
-  name: {{ .Release.Name }}-webhook-ready
-  namespace: {{ .Release.Namespace }}
-  annotations:
-    helm.sh/hook: post-install,post-upgrade
-    helm.sh/hook-weight: "10"
-    helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
-spec:
-  backoffLimit: {{ .Values.webhookReady.backoffLimit | default 2 }}
-  activeDeadlineSeconds: {{ $deadline }}
-  template:
-    spec:
-      restartPolicy: Never
-      serviceAccountName: {{ .Release.Name }}-webhook-ready
-      securityContext:
-        runAsNonRoot: true
-        runAsUser: 65532
-        runAsGroup: 65532
-        seccompProfile:
-          type: RuntimeDefault
-      containers:
-        - name: wait
-          image: {{ $image }}
-          imagePullPolicy: {{ if .Values.webhookReady.image.digest }}IfNotPresent{{ else }}Always{{ end }}
-          resources:
-            requests:
-              cpu: 10m
-              memory: 32Mi
-            limits:
-              cpu: 100m
-              memory: 64Mi
-          securityContext:
-            allowPrivilegeEscalation: false
-            readOnlyRootFilesystem: true
-            capabilities:
-              drop: ["ALL"]
-          command:
-            - sh
-            - -c
-            - |
-              set -e
-              ns={{ .Release.Namespace }}
-              proxy="/api/v1/namespaces/${ns}/services/{{ $resourceName }}/proxy/readyz"
-              max_attempts={{ $maxAttempts }}
-              sleep_seconds={{ $sleepSeconds }}
-              i=0
-              last_err=""
-              until last_err=$(kubectl get --raw "$proxy" 2>&1 >/dev/null); do
-                i=$((i + 1))
-                if [ $i -gt $max_attempts ]; then
-                  echo "timeout: cnpg webhook did not respond through the apiserver proxy after ${max_attempts} attempts (${sleep_seconds}s each)"
-                  echo "last error: ${last_err}"
-                  exit 1
-                fi
-                if [ $((i % 10)) -eq 1 ]; then
-                  echo "attempt $i/${max_attempts}: ${last_err}"
-                fi
-                sleep "$sleep_seconds"
-              done
-              echo "cnpg webhook is ready"
diff --git a/packages/system/postgres-operator/tests/webhook-ready-hook_test.yaml b/packages/system/postgres-operator/tests/webhook-ready-hook_test.yaml
deleted file mode 100644
index 3253c663..00000000
--- a/packages/system/postgres-operator/tests/webhook-ready-hook_test.yaml
+++ /dev/null
@@ -1,328 +0,0 @@
-suite: cnpg webhook post-install readiness gate
-
-templates:
-  - templates/webhook-ready-hook.yaml
-  - charts/cloudnative-pg/templates/service.yaml
-
-release:
-  name: postgres-operator
-  namespace: cozy-postgres-operator
-
-tests:
-  - it: renders four hook objects (SA + Role + RoleBinding + Job)
-    template: templates/webhook-ready-hook.yaml
-    asserts:
-      - hasDocuments:
-          count: 4
-
-  - it: every rendered object carries post-install and post-upgrade hook annotations
-    template: templates/webhook-ready-hook.yaml
-    asserts:
-      - documentIndex: 0
-        equal:
-          path: metadata.annotations["helm.sh/hook"]
-          value: post-install,post-upgrade
-      - documentIndex: 1
-        equal:
-          path: metadata.annotations["helm.sh/hook"]
-          value: post-install,post-upgrade
-      - documentIndex: 2
-        equal:
-          path: metadata.annotations["helm.sh/hook"]
-          value: post-install,post-upgrade
-      - documentIndex: 3
-        equal:
-          path: metadata.annotations["helm.sh/hook"]
-          value: post-install,post-upgrade
-
-  - it: RBAC is created before the Job (hook-weight ordering)
-    template: templates/webhook-ready-hook.yaml
-    asserts:
-      - documentIndex: 0
-        equal:
-          path: kind
-          value: ServiceAccount
-      - documentIndex: 0
-        equal:
-          path: metadata.annotations["helm.sh/hook-weight"]
-          value: "0"
-      - documentIndex: 1
-        equal:
-          path: kind
-          value: Role
-      - documentIndex: 1
-        equal:
-          path: metadata.annotations["helm.sh/hook-weight"]
-          value: "0"
-      - documentIndex: 2
-        equal:
-          path: kind
-          value: RoleBinding
-      - documentIndex: 2
-        equal:
-          path: metadata.annotations["helm.sh/hook-weight"]
-          value: "0"
-      - documentIndex: 3
-        equal:
-          path: kind
-          value: Job
-      - documentIndex: 3
-        equal:
-          path: metadata.annotations["helm.sh/hook-weight"]
-          value: "10"
-
-  - it: RBAC resourceName matches the exact proxy URL segment the Job probes
-    template: templates/webhook-ready-hook.yaml
-    asserts:
-      - documentIndex: 1
-        equal:
-          path: rules[0].resources[0]
-          value: services/proxy
-      - documentIndex: 1
-        equal:
-          path: rules[0].resourceNames[0]
-          value: https:cnpg-webhook-service:webhook-server
-      - documentIndex: 3
-        matchRegex:
-          path: spec.template.spec.containers[0].command[2]
-          pattern: "/api/v1/namespaces/\\$\\{ns\\}/services/https:cnpg-webhook-service:webhook-server/proxy/readyz"
-
-  - it: hardcoded service name in the hook matches the vendored cnpg subchart Service (drift guard for make update)
-    template: charts/cloudnative-pg/templates/service.yaml
-    asserts:
-      - equal:
-          path: metadata.name
-          value: cnpg-webhook-service
-      - equal:
-          path: spec.ports[0].name
-          value: webhook-server
-
-  - it: Job calls kubectl get --raw on the proxy path
-    template: templates/webhook-ready-hook.yaml
-    asserts:
-      - documentIndex: 3
-        matchRegex:
-          path: spec.template.spec.containers[0].command[2]
-          pattern: "kubectl get --raw"
-
-  - it: Job image is digest-pinned when webhookReady.image.digest is set
-    template: templates/webhook-ready-hook.yaml
-    set:
-      webhookReady:
-        image:
-          repository: docker.io/clastix/kubectl
-          tag: v1.32
-          digest: sha256:b9ef7d8dbe65bcc81a46c09b8dc7543103055021c4f43287bf59e92a8f4fe05c
-    asserts:
-      - documentIndex: 3
-        equal:
-          path: spec.template.spec.containers[0].image
-          value: docker.io/clastix/kubectl:v1.32@sha256:b9ef7d8dbe65bcc81a46c09b8dc7543103055021c4f43287bf59e92a8f4fe05c
-
-  - it: Job image falls back to tag-only when digest is not configured
-    template: templates/webhook-ready-hook.yaml
-    set:
-      webhookReady:
-        image:
-          repository: docker.io/clastix/kubectl
-          tag: v1.32
-          digest: ""
-    asserts:
-      - documentIndex: 3
-        equal:
-          path: spec.template.spec.containers[0].image
-          value: docker.io/clastix/kubectl:v1.32
-
-  - it: backoffLimit defaults to 2 so transient pod-level failures retry instead of killing the HelmRelease
-    template: templates/webhook-ready-hook.yaml
-    asserts:
-      - documentIndex: 3
-        equal:
-          path: spec.backoffLimit
-          value: 2
-
-  - it: backoffLimit is overridable
-    template: templates/webhook-ready-hook.yaml
-    set:
-      webhookReady:
-        backoffLimit: 5
-    asserts:
-      - documentIndex: 3
-        equal:
-          path: spec.backoffLimit
-          value: 5
-
-  - it: chart render fails when webhookReady.image.repository is empty
-    template: templates/webhook-ready-hook.yaml
-    set:
-      webhookReady:
-        image:
-          repository: ""
-          tag: v1.32
-    asserts:
-      - failedTemplate:
-          errorMessage: "webhookReady.image.repository must be set to the container image providing kubectl for the post-install readiness Job"
-
-  - it: chart render fails when webhookReady.image.tag is empty
-    template: templates/webhook-ready-hook.yaml
-    set:
-      webhookReady:
-        image:
-          repository: docker.io/clastix/kubectl
-          tag: ""
-    asserts:
-      - failedTemplate:
-          errorMessage: "webhookReady.image.tag must be set for the post-install readiness Job"
-
-  - it: retry loop bounds default when blanked so a wiped override still produces a working Job
-    template: templates/webhook-ready-hook.yaml
-    set:
-      webhookReady:
-        image:
-          repository: docker.io/clastix/kubectl
-          tag: v1.32
-        maxAttempts: null
-        sleepSeconds: null
-    asserts:
-      - documentIndex: 3
-        matchRegex:
-          path: spec.template.spec.containers[0].command[2]
-          pattern: "max_attempts=60"
-      - documentIndex: 3
-        matchRegex:
-          path: spec.template.spec.containers[0].command[2]
-          pattern: "sleep_seconds=2"
-
-  - it: Job pod runs non-root with seccomp RuntimeDefault for restricted-PSA clusters
-    template: templates/webhook-ready-hook.yaml
-    asserts:
-      - documentIndex: 3
-        equal:
-          path: spec.template.spec.securityContext.runAsNonRoot
-          value: true
-      - documentIndex: 3
-        equal:
-          path: spec.template.spec.securityContext.seccompProfile.type
-          value: RuntimeDefault
-
-  - it: wait container declares resource requests and limits for predictable scheduling
-    template: templates/webhook-ready-hook.yaml
-    asserts:
-      - documentIndex: 3
-        equal:
-          path: spec.template.spec.containers[0].resources.requests.cpu
-          value: 10m
-      - documentIndex: 3
-        equal:
-          path: spec.template.spec.containers[0].resources.requests.memory
-          value: 32Mi
-      - documentIndex: 3
-        equal:
-          path: spec.template.spec.containers[0].resources.limits.cpu
-          value: 100m
-      - documentIndex: 3
-        equal:
-          path: spec.template.spec.containers[0].resources.limits.memory
-          value: 64Mi
-
-  - it: Job container drops all capabilities and runs read-only rootfs
-    template: templates/webhook-ready-hook.yaml
-    asserts:
-      - documentIndex: 3
-        equal:
-          path: spec.template.spec.containers[0].securityContext.allowPrivilegeEscalation
-          value: false
-      - documentIndex: 3
-        equal:
-          path: spec.template.spec.containers[0].securityContext.readOnlyRootFilesystem
-          value: true
-      - documentIndex: 3
-        equal:
-          path: spec.template.spec.containers[0].securityContext.capabilities.drop[0]
-          value: ALL
-
-  - it: imagePullPolicy is IfNotPresent when digest-pinned, Always when tag-only
-    template: templates/webhook-ready-hook.yaml
-    set:
-      webhookReady:
-        image:
-          repository: docker.io/clastix/kubectl
-          tag: v1.32
-          digest: sha256:b9ef7d8dbe65bcc81a46c09b8dc7543103055021c4f43287bf59e92a8f4fe05c
-    asserts:
-      - documentIndex: 3
-        equal:
-          path: spec.template.spec.containers[0].imagePullPolicy
-          value: IfNotPresent
-
-  - it: imagePullPolicy is Always when no digest is configured
-    template: templates/webhook-ready-hook.yaml
-    set:
-      webhookReady:
-        image:
-          repository: docker.io/clastix/kubectl
-          tag: v1.32
-          digest: ""
-    asserts:
-      - documentIndex: 3
-        equal:
-          path: spec.template.spec.containers[0].imagePullPolicy
-          value: Always
-
-  - it: retry loop captures and surfaces the last kubectl error message on timeout
-    template: templates/webhook-ready-hook.yaml
-    asserts:
-      - documentIndex: 3
-        matchRegex:
-          path: spec.template.spec.containers[0].command[2]
-          pattern: 'last_err=\$\(kubectl get --raw'
-      - documentIndex: 3
-        matchRegex:
-          path: spec.template.spec.containers[0].command[2]
-          pattern: 'last error: \$\{last_err\}'
-
-  - it: retry loop error message stays in sync when maxAttempts is bumped
-    template: templates/webhook-ready-hook.yaml
-    set:
-      webhookReady:
-        image:
-          repository: docker.io/clastix/kubectl
-          tag: v1.32
-        maxAttempts: 90
-        sleepSeconds: 3
-    asserts:
-      - documentIndex: 3
-        matchRegex:
-          path: spec.template.spec.containers[0].command[2]
-          pattern: "max_attempts=90"
-      - documentIndex: 3
-        matchRegex:
-          path: spec.template.spec.containers[0].command[2]
-          pattern: "sleep_seconds=3"
-      - documentIndex: 3
-        matchRegex:
-          path: spec.template.spec.containers[0].command[2]
-          pattern: 'after \$\{max_attempts\} attempts'
-
-  - it: activeDeadlineSeconds scales with retry bounds so an override raise does not silently cut
-    template: templates/webhook-ready-hook.yaml
-    set:
-      webhookReady:
-        image:
-          repository: docker.io/clastix/kubectl
-          tag: v1.32
-        maxAttempts: 180
-        sleepSeconds: 3
-    asserts:
-      - documentIndex: 3
-        equal:
-          path: spec.activeDeadlineSeconds
-          value: 600
-
-  - it: activeDeadlineSeconds defaults include 60s slack over the default retry window
-    template: templates/webhook-ready-hook.yaml
-    asserts:
-      - documentIndex: 3
-        equal:
-          path: spec.activeDeadlineSeconds
-          value: 180
diff --git a/packages/system/postgres-operator/values.yaml b/packages/system/postgres-operator/values.yaml
index c408220e..cae3dc53 100644
--- a/packages/system/postgres-operator/values.yaml
+++ b/packages/system/postgres-operator/values.yaml
@@ -3,30 +3,3 @@ cloudnative-pg:
     create: true
   image:
     tag: "1.27.3"
-# Image used by the post-install webhook-readiness Job (see templates/webhook-ready-hook.yaml).
-# Any image with kubectl on PATH works; the Job calls the apiserver service proxy with the
-# hook ServiceAccount's token to confirm the mcluster.cnpg.io webhook is reachable end-to-end
-# before the HelmRelease reports Ready, closing the "connection refused" bootstrap race.
-#
-# The tag is digest-pinned so an upstream retag does not change what runs on every install
-# and upgrade across the fleet. Refresh by resolving the current manifest-list digest
-# (`docker manifest inspect docker.io/clastix/kubectl:v1.32`) and updating `digest` below.
-# renovate: datasource=docker depName=docker.io/clastix/kubectl
-webhookReady:
-  image:
-    repository: docker.io/clastix/kubectl
-    tag: v1.32
-    digest: sha256:b9ef7d8dbe65bcc81a46c09b8dc7543103055021c4f43287bf59e92a8f4fe05c
-  # Retry loop bounds for the readiness probe. Defaults total ~120s wall clock.
-  # Both are `default`-coerced in the template so an override that blanks them still
-  # produces a working Job.
-  maxAttempts: 60
-  sleepSeconds: 2
-  # Pod-level retry budget for transient node/registry failures (image pull rate limit,
-  # OOM, CNI hiccup). The shell loop inside the container only covers reachability retries.
-  # Pod retries and activeDeadlineSeconds (wall-clock bound on the whole Job across all
-  # pod retries) are ANDed, so activeDeadlineSeconds is the shorter of the two gates with
-  # the defaults above: the 60*2+60 = 180s deadline cuts the Job before backoffLimit=2
-  # ever matters if pod-level failures eat more than ~60s of the budget. Raise
-  # maxAttempts/sleepSeconds alongside backoffLimit when tuning for slow image pulls.
-  backoffLimit: 2
diff --git a/packages/system/postgres-rd/cozyrds/postgres.yaml b/packages/system/postgres-rd/cozyrds/postgres.yaml
index 72d013f1..c74c5783 100644
--- a/packages/system/postgres-rd/cozyrds/postgres.yaml
+++ b/packages/system/postgres-rd/cozyrds/postgres.yaml
@@ -8,7 +8,7 @@ spec:
     singular: postgres
     plural: postgreses
     openAPISchema: |-
-      {"title":"Chart Values","type":"object","properties":{"replicas":{"description":"Number of Postgres replicas.","type":"integer","default":2},"resources":{"description":"Explicit CPU and memory configuration for each PostgreSQL replica. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"micro","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"size":{"description":"Persistent Volume Claim size available for application data.","default":"10Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"storageClass":{"description":"StorageClass used to store the data.","type":"string","default":""},"external":{"description":"Enable external access from outside the cluster.","type":"boolean","default":false},"version":{"description":"PostgreSQL major version to deploy","type":"string","default":"v18","enum":["v18","v17","v16","v15","v14","v13"]},"postgresql":{"description":"PostgreSQL server configuration.","type":"object","default":{},"properties":{"parameters":{"description":"PostgreSQL server parameters.","type":"object","default":{},"properties":{"max_connections":{"description":"Maximum number of concurrent connections to the database server.","type":"integer","default":100}}}}},"quorum":{"description":"Quorum configuration for synchronous replication.","type":"object","default":{},"required":["maxSyncReplicas","minSyncReplicas"],"properties":{"maxSyncReplicas":{"description":"Maximum number of synchronous replicas allowed (must be less than total replicas).","type":"integer","default":0},"minSyncReplicas":{"description":"Minimum number of synchronous replicas required for commit.","type":"integer","default":0}}},"users":{"description":"Users configuration map.","type":"object","default":{},"additionalProperties":{"type":"object","properties":{"password":{"description":"Password for the user.","type":"string"},"replication":{"description":"Whether the user has replication privileges.","type":"boolean"}}}},"databases":{"description":"Databases configuration map.","type":"object","default":{},"additionalProperties":{"type":"object","properties":{"extensions":{"description":"List of enabled PostgreSQL extensions.","type":"array","items":{"type":"string"}},"roles":{"description":"Roles assigned to users.","type":"object","properties":{"admin":{"description":"List of users with admin privileges.","type":"array","items":{"type":"string"}},"readonly":{"description":"List of users with read-only privileges.","type":"array","items":{"type":"string"}}}}}}},"backup":{"description":"Backup configuration.","type":"object","default":{},"required":["enabled"],"properties":{"destinationPath":{"description":"Destination path for backups (e.g. s3://bucket/path/).","type":"string","default":"s3://bucket/path/to/folder/"},"enabled":{"description":"Enable regular backups.","type":"boolean","default":false},"endpointURL":{"description":"S3 endpoint URL for uploads.","type":"string","default":"http://minio-gateway-service:9000"},"retentionPolicy":{"description":"Retention policy (e.g. \"30d\").","type":"string","default":"30d"},"s3AccessKey":{"description":"Access key for S3 authentication.","type":"string","default":"<your-access-key>"},"s3SecretKey":{"description":"Secret key for S3 authentication.","type":"string","default":"<your-secret-key>"},"schedule":{"description":"Cron schedule for automated backups.","type":"string","default":"0 2 * * * *"}}},"bootstrap":{"description":"Bootstrap configuration.","type":"object","default":{},"required":["enabled","oldName"],"properties":{"enabled":{"description":"Whether to restore from a backup.","type":"boolean","default":false},"oldName":{"description":"Previous cluster name before deletion.","type":"string","default":""},"recoveryTime":{"description":"Timestamp (RFC3339) for point-in-time recovery; empty means latest.","type":"string","default":""},"serverName":{"description":"Barman server name (S3 path prefix) used by the original cluster when writing backups. Set this only when the original cluster had an explicit barmanObjectStore.serverName that differed from its Kubernetes resource name.","type":"string","default":""}}}}}
+      {"title":"Chart Values","type":"object","properties":{"replicas":{"description":"Number of Postgres replicas.","type":"integer","default":2},"resources":{"description":"Explicit CPU and memory configuration for each PostgreSQL replica. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available to each replica.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"micro","enum":["nano","micro","small","medium","large","xlarge","2xlarge"]},"size":{"description":"Persistent Volume Claim size available for application data.","default":"10Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"storageClass":{"description":"StorageClass used to store the data.","type":"string","default":""},"external":{"description":"Enable external access from outside the cluster.","type":"boolean","default":false},"version":{"description":"PostgreSQL major version to deploy","type":"string","default":"v18","enum":["v18","v17","v16","v15","v14","v13"]},"postgresql":{"description":"PostgreSQL server configuration.","type":"object","default":{},"properties":{"parameters":{"description":"PostgreSQL server parameters.","type":"object","default":{},"properties":{"max_connections":{"description":"Maximum number of concurrent connections to the database server.","type":"integer","default":100}}}}},"quorum":{"description":"Quorum configuration for synchronous replication.","type":"object","default":{},"required":["maxSyncReplicas","minSyncReplicas"],"properties":{"maxSyncReplicas":{"description":"Maximum number of synchronous replicas allowed (must be less than total replicas).","type":"integer","default":0},"minSyncReplicas":{"description":"Minimum number of synchronous replicas required for commit.","type":"integer","default":0}}},"users":{"description":"Users configuration map.","type":"object","default":{},"additionalProperties":{"type":"object","properties":{"password":{"description":"Password for the user.","type":"string"},"replication":{"description":"Whether the user has replication privileges.","type":"boolean"}}}},"databases":{"description":"Databases configuration map.","type":"object","default":{},"additionalProperties":{"type":"object","properties":{"extensions":{"description":"List of enabled PostgreSQL extensions.","type":"array","items":{"type":"string"}},"roles":{"description":"Roles assigned to users.","type":"object","properties":{"admin":{"description":"List of users with admin privileges.","type":"array","items":{"type":"string"}},"readonly":{"description":"List of users with read-only privileges.","type":"array","items":{"type":"string"}}}}}}},"backup":{"description":"Backup configuration.","type":"object","default":{},"required":["enabled"],"properties":{"destinationPath":{"description":"Destination path for backups (e.g. s3://bucket/path/).","type":"string","default":"s3://bucket/path/to/folder/"},"enabled":{"description":"Enable regular backups.","type":"boolean","default":false},"endpointURL":{"description":"S3 endpoint URL for uploads.","type":"string","default":"http://minio-gateway-service:9000"},"retentionPolicy":{"description":"Retention policy (e.g. \"30d\").","type":"string","default":"30d"},"s3AccessKey":{"description":"Access key for S3 authentication.","type":"string","default":"<your-access-key>"},"s3SecretKey":{"description":"Secret key for S3 authentication.","type":"string","default":"<your-secret-key>"},"schedule":{"description":"Cron schedule for automated backups.","type":"string","default":"0 2 * * * *"}}},"bootstrap":{"description":"Bootstrap configuration.","type":"object","default":{},"required":["enabled","oldName"],"properties":{"enabled":{"description":"Whether to restore from a backup.","type":"boolean","default":false},"oldName":{"description":"Previous cluster name before deletion.","type":"string","default":""},"recoveryTime":{"description":"Timestamp (RFC3339) for point-in-time recovery; empty means latest.","type":"string","default":""}}}}}
   release:
     prefix: postgres-
     labels:
@@ -33,7 +33,7 @@ spec:
     #    labelSelector:
     #      helm.toolkit.fluxcd.io/name: "{reqs[0]['metadata','name']}"
 
-    keysOrder: [["apiVersion"], ["appVersion"], ["kind"], ["metadata"], ["metadata", "name"], ["spec", "replicas"], ["spec", "resources"], ["spec", "resourcesPreset"], ["spec", "size"], ["spec", "storageClass"], ["spec", "external"], ["spec", "version"], ["spec", "postgresql"], ["spec", "postgresql", "parameters"], ["spec", "postgresql", "parameters", "max_connections"], ["spec", "quorum"], ["spec", "quorum", "minSyncReplicas"], ["spec", "quorum", "maxSyncReplicas"], ["spec", "users"], ["spec", "databases"], ["spec", "backup"], ["spec", "backup", "enabled"], ["spec", "backup", "retentionPolicy"], ["spec", "backup", "destinationPath"], ["spec", "backup", "endpointURL"], ["spec", "backup", "schedule"], ["spec", "backup", "s3AccessKey"], ["spec", "backup", "s3SecretKey"], ["spec", "bootstrap"], ["spec", "bootstrap", "enabled"], ["spec", "bootstrap", "recoveryTime"], ["spec", "bootstrap", "oldName"], ["spec", "bootstrap", "serverName"]]
+    keysOrder: [["apiVersion"], ["appVersion"], ["kind"], ["metadata"], ["metadata", "name"], ["spec", "replicas"], ["spec", "resources"], ["spec", "resourcesPreset"], ["spec", "size"], ["spec", "storageClass"], ["spec", "external"], ["spec", "version"], ["spec", "postgresql"], ["spec", "postgresql", "parameters"], ["spec", "postgresql", "parameters", "max_connections"], ["spec", "quorum"], ["spec", "quorum", "minSyncReplicas"], ["spec", "quorum", "maxSyncReplicas"], ["spec", "users"], ["spec", "databases"], ["spec", "backup"], ["spec", "backup", "enabled"], ["spec", "backup", "retentionPolicy"], ["spec", "backup", "destinationPath"], ["spec", "backup", "endpointURL"], ["spec", "backup", "schedule"], ["spec", "backup", "s3AccessKey"], ["spec", "backup", "s3SecretKey"], ["spec", "bootstrap"], ["spec", "bootstrap", "enabled"], ["spec", "bootstrap", "recoveryTime"], ["spec", "bootstrap", "oldName"]]
   secrets:
     exclude: []
     include:
diff --git a/packages/system/vm-instance-rd/cozyrds/vm-instance.yaml b/packages/system/vm-instance-rd/cozyrds/vm-instance.yaml
index e56bd9dd..e93fa86b 100644
--- a/packages/system/vm-instance-rd/cozyrds/vm-instance.yaml
+++ b/packages/system/vm-instance-rd/cozyrds/vm-instance.yaml
@@ -8,7 +8,7 @@ spec:
     singular: vminstance
     plural: vminstances
     openAPISchema: |-
-      {"title":"Chart Values","type":"object","properties":{"external":{"description":"Enable external access from outside the cluster.","type":"boolean","default":false},"externalMethod":{"description":"Method to pass through traffic to the VM.","type":"string","default":"PortList","enum":["PortList","WholeIP"]},"externalPorts":{"description":"Ports to forward from outside the cluster.","type":"array","default":[22],"items":{"type":"integer"}},"externalAllowICMP":{"description":"Whether to accept ICMP traffic to the VM in PortList mode (preserves ping and PMTU discovery). No effect in WholeIP mode. Default true so ping behaves as users expect even when port filtering is in effect.","type":"boolean","default":true},"runStrategy":{"description":"Requested running state of the VirtualMachineInstance","type":"string","default":"Always","enum":["Always","Halted","Manual","RerunOnFailure","Once"]},"instanceType":{"description":"Virtual Machine instance type.","type":"string","default":"u1.medium"},"instanceProfile":{"description":"Virtual Machine preferences profile.","type":"string","default":"ubuntu","enum":["alpine","centos.7","centos.7.desktop","centos.stream10","centos.stream10.desktop","centos.stream8","centos.stream8.desktop","centos.stream8.dpdk","centos.stream9","centos.stream9.desktop","centos.stream9.dpdk","cirros","fedora","fedora.arm64","opensuse.leap","opensuse.tumbleweed","rhel.10","rhel.10.arm64","rhel.7","rhel.7.desktop","rhel.8","rhel.8.desktop","rhel.8.dpdk","rhel.9","rhel.9.arm64","rhel.9.desktop","rhel.9.dpdk","rhel.9.realtime","sles","ubuntu","windows.10","windows.10.virtio","windows.11","windows.11.virtio","windows.2k16","windows.2k16.virtio","windows.2k19","windows.2k19.virtio","windows.2k22","windows.2k22.virtio","windows.2k25","windows.2k25.virtio",""]},"disks":{"description":"List of disks to attach.","type":"array","default":[],"items":{"type":"object","required":["name"],"properties":{"bus":{"description":"Disk bus type (e.g. \"sata\").","type":"string"},"name":{"description":"Disk name.","type":"string"}}}},"networks":{"description":"Networks to attach the VM to.","type":"array","default":[],"items":{"type":"object","properties":{"name":{"description":"Network attachment name.","type":"string"}}}},"subnets":{"description":"Deprecated: use networks instead.","type":"array","default":[],"items":{"type":"object","properties":{"name":{"description":"Network attachment name.","type":"string"}}}},"gpus":{"description":"List of GPUs to attach (NVIDIA driver requires at least 4 GiB RAM).","type":"array","default":[],"items":{"type":"object","required":["name"],"properties":{"name":{"description":"The name of the GPU resource to attach.","type":"string"}}}},"cpuModel":{"description":"Model specifies the CPU model inside the VMI. List of available models https://github.com/libvirt/libvirt/tree/master/src/cpu_map","type":"string","default":""},"resources":{"description":"Resource configuration for the virtual machine.","type":"object","default":{},"properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"sockets":{"description":"Number of CPU sockets (vCPU topology).","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"sshKeys":{"description":"List of SSH public keys for authentication.","type":"array","default":[],"items":{"type":"string"}},"cloudInit":{"description":"Cloud-init user data.","type":"string","default":""},"cloudInitSeed":{"description":"Seed string to generate SMBIOS UUID for the VM.","type":"string","default":""}}}
+      {"title":"Chart Values","type":"object","properties":{"external":{"description":"Enable external access from outside the cluster.","type":"boolean","default":false},"externalMethod":{"description":"Method to pass through traffic to the VM.","type":"string","default":"PortList","enum":["PortList","WholeIP"]},"externalPorts":{"description":"Ports to forward from outside the cluster.","type":"array","default":[22],"items":{"type":"integer"}},"runStrategy":{"description":"Requested running state of the VirtualMachineInstance","type":"string","default":"Always","enum":["Always","Halted","Manual","RerunOnFailure","Once"]},"instanceType":{"description":"Virtual Machine instance type.","type":"string","default":"u1.medium"},"instanceProfile":{"description":"Virtual Machine preferences profile.","type":"string","default":"ubuntu","enum":["alpine","centos.7","centos.7.desktop","centos.stream10","centos.stream10.desktop","centos.stream8","centos.stream8.desktop","centos.stream8.dpdk","centos.stream9","centos.stream9.desktop","centos.stream9.dpdk","cirros","fedora","fedora.arm64","opensuse.leap","opensuse.tumbleweed","rhel.10","rhel.10.arm64","rhel.7","rhel.7.desktop","rhel.8","rhel.8.desktop","rhel.8.dpdk","rhel.9","rhel.9.arm64","rhel.9.desktop","rhel.9.dpdk","rhel.9.realtime","sles","ubuntu","windows.10","windows.10.virtio","windows.11","windows.11.virtio","windows.2k16","windows.2k16.virtio","windows.2k19","windows.2k19.virtio","windows.2k22","windows.2k22.virtio","windows.2k25","windows.2k25.virtio",""]},"disks":{"description":"List of disks to attach.","type":"array","default":[],"items":{"type":"object","required":["name"],"properties":{"bus":{"description":"Disk bus type (e.g. \"sata\").","type":"string"},"name":{"description":"Disk name.","type":"string"}}}},"networks":{"description":"Networks to attach the VM to.","type":"array","default":[],"items":{"type":"object","properties":{"name":{"description":"Network attachment name.","type":"string"}}}},"subnets":{"description":"Deprecated: use networks instead.","type":"array","default":[],"items":{"type":"object","properties":{"name":{"description":"Network attachment name.","type":"string"}}}},"gpus":{"description":"List of GPUs to attach (NVIDIA driver requires at least 4 GiB RAM).","type":"array","default":[],"items":{"type":"object","required":["name"],"properties":{"name":{"description":"The name of the GPU resource to attach.","type":"string"}}}},"cpuModel":{"description":"Model specifies the CPU model inside the VMI. List of available models https://github.com/libvirt/libvirt/tree/master/src/cpu_map","type":"string","default":""},"resources":{"description":"Resource configuration for the virtual machine.","type":"object","default":{},"properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"sockets":{"description":"Number of CPU sockets (vCPU topology).","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"sshKeys":{"description":"List of SSH public keys for authentication.","type":"array","default":[],"items":{"type":"string"}},"cloudInit":{"description":"Cloud-init user data.","type":"string","default":""},"cloudInitSeed":{"description":"Seed string to generate SMBIOS UUID for the VM.","type":"string","default":""}}}
   release:
     prefix: vm-instance-
     labels:
@@ -26,7 +26,7 @@ spec:
     tags:
       - compute
     icon: PHN2ZyB3aWR0aD0iMTQ0IiBoZWlnaHQ9IjE0NCIgdmlld0JveD0iMCAwIDE0NCAxNDQiIGZpbGw9Im5vbmUiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyI+CjxyZWN0IHdpZHRoPSIxNDQiIGhlaWdodD0iMTQ0IiByeD0iMjQiIGZpbGw9InVybCgjcGFpbnQwX2xpbmVhcl82ODdfMzQ1NCkiLz4KPGcgY2xpcC1wYXRoPSJ1cmwoI2NsaXAwXzY4N18zNDU0KSI+CjxwYXRoIGQ9Ik04OS41MDM5IDExMS43MDdINTQuNDk3QzU0LjE3MjcgMTExLjcwNyA1NC4wMTA4IDExMS4yMjEgNTQuMzM0OSAxMTEuMDU5TDU3LjI1MjIgMTA4Ljk1MkM2MC4zMzE0IDEwNi42ODMgNjEuOTUyMiAxMDIuNjMxIDYwLjk3OTcgOTguNzQxMkg4My4wMjFDODIuMDQ4NSAxMDIuNjMxIDgzLjY2OTMgMTA2LjY4MyA4Ni43NDg1IDEwOC45NTJMODkuNjY1OCAxMTEuMDU5Qzg5Ljk5IDExMS4yMjEgODkuODI3OSAxMTEuNzA3IDg5LjUwMzkgMTExLjcwN1oiIGZpbGw9IiNCMEI2QkIiLz4KPHBhdGggZD0iTTExMy4zMjggOTguNzQxSDMwLjY3MjVDMjcuNTkzMSA5OC43NDEgMjUgOTYuMTQ4IDI1IDkzLjA2ODdWMzMuMTAzMkMyNSAzMC4wMjM5IDI3LjU5MzEgMjcuNDMwNyAzMC42NzI1IDI3LjQzMDdIMTEzLjMyOEMxMTYuNDA3IDI3LjQzMDcgMTE5IDMwLjAyMzcgMTE5IDMzLjEwMzJWOTMuMDY4N0MxMTkgOTYuMTQ4IDExNi40MDcgOTguNzQxIDExMy4zMjggOTguNzQxWiIgZmlsbD0iI0U4RURFRSIvPgo8cGF0aCBkPSJNMTE5IDg0LjE1NDlIMjVWMzMuMTAzMkMyNSAzMC4wMjM5IDI3LjU5MzEgMjcuNDMwNyAzMC42NzI1IDI3LjQzMDdIMTEzLjMyOEMxMTYuNDA3IDI3LjQzMDcgMTE5IDMwLjAyMzcgMTE5IDMzLjEwMzJMMTE5IDg0LjE1NDlaIiBmaWxsPSIjMDBCM0ZGIi8+CjxwYXRoIGQ9Ik05MC42Mzc0IDExNi41NjlINTMuMzYxNkM1Mi4wNjUxIDExNi41NjkgNTAuOTMwNyAxMTUuNDM1IDUwLjkzMDcgMTE0LjEzOEM1MC45MzA3IDExMi44NDEgNTIuMDY1MSAxMTEuNzA3IDUzLjM2MTYgMTExLjcwN0g5MC42Mzc0QzkxLjkzMzkgMTExLjcwNyA5My4wNjg0IDExMi44NDEgOTMuMDY4NCAxMTQuMTM4QzkzLjA2ODQgMTE1LjQzNSA5MS45MzM5IDExNi41NjkgOTAuNjM3NCAxMTYuNTY5WiIgZmlsbD0iI0U4RURFRSIvPgo8L2c+CjxwYXRoIGQ9Ik03Mi41Mjc1IDUzLjgzNjdDNzIuNDQzMSA1My44MzUxIDcyLjM2MDUgNTMuODEyMiA3Mi4yODczIDUzLjc3MDFMNTYuNDY5OSA0NC43OTM0QzU2LjM5ODMgNDQuNzUxOSA1Ni4zMzg4IDQ0LjY5MjMgNTYuMjk3MyA0NC42MjA3QzU2LjI1NTkgNDQuNTQ5IDU2LjIzMzggNDQuNDY3OCA1Ni4yMzM0IDQ0LjM4NUM1Ni4yMzM0IDQ0LjIxNjkgNTYuMzI1OCA0NC4wNjE3IDU2LjQ2OTkgNDMuOTc4NUw3Mi4xOTEyIDM1LjA2MDlDNzIuMjYzNyAzNS4wMjEgNzIuMzQ1IDM1IDcyLjQyNzcgMzVDNzIuNTEwNSAzNSA3Mi41OTE4IDM1LjAyMSA3Mi42NjQzIDM1LjA2MDlMODguNDg3MiA0NC4wMzk1Qzg4LjU1OTEgNDQuMDgwMSA4OC42MTg4IDQ0LjEzOTIgODguNjYgNDQuMjEwN0M4OC43MDEzIDQ0LjI4MjIgODguNzIyNyA0NC4zNjM1IDg4LjcyMTkgNDQuNDQ2Qzg4LjcyMjUgNDQuNTI4NSA4OC43MDEgNDQuNjA5NyA4OC42NTk4IDQ0LjY4MTJDODguNjE4NSA0NC43NTI2IDg4LjU1ODkgNDQuODExOCA4OC40ODcyIDQ0Ljg1MjVMNzIuNzcxNCA1My43NjgzQzcyLjY5NzIgNTMuODExNCA3Mi42MTMzIDUzLjgzNDkgNzIuNTI3NSA1My44MzY3IiBmaWxsPSJ3aGl0ZSIvPgo8cGF0aCBvcGFjaXR5PSIwLjciIGQ9Ik03MC4yNTUzIDc1LjY1MTdDNzAuMTcxIDc1LjY1MzUgNzAuMDg3OCA3NS42MzE3IDcwLjAxNTEgNzUuNTg4OEw1NC4yNDU4IDY2LjY0MTdDNTQuMTcxNSA2Ni42MDI0IDU0LjEwOTUgNjYuNTQzNiA1NC4wNjYxIDY2LjQ3MTZDNTQuMDIyOCA2Ni4zOTk3IDU0IDY2LjMxNzMgNTQgNjYuMjMzM1Y0OC4yNzhDNTQgNDguMTA4IDU0LjA5MjQgNDcuOTU0NiA1NC4yNDM5IDQ3Ljg2OTZDNTQuMzE3MiA0Ny44MjcxIDU0LjQwMDQgNDcuODA0NyA1NC40ODUxIDQ3LjgwNDdDNTQuNTY5NyA0Ny44MDQ3IDU0LjY1MjkgNDcuODI3MSA1NC43MjYyIDQ3Ljg2OTZMNzAuNDkzNyA1Ni44MTMxQzcwLjU2NDIgNTYuODU2NSA3MC42MjI1IDU2LjkxNyA3MC42NjMyIDU2Ljk4OTFDNzAuNzAzOSA1Ny4wNjEyIDcwLjcyNTcgNTcuMTQyNCA3MC43MjY1IDU3LjIyNTFWNzUuMTgwNUM3MC43MjU5IDc1LjI2MjggNzAuNzA0MiA3NS4zNDM2IDcwLjY2MzUgNzUuNDE1MUM3MC42MjI3IDc1LjQ4NjYgNzAuNTY0MiA3NS41NDY0IDcwLjQ5MzcgNzUuNTg4OEM3MC40MjA2IDc1LjYyOTEgNzAuMzM4NyA3NS42NTA3IDcwLjI1NTMgNzUuNjUxNyIgZmlsbD0id2hpdGUiLz4KPHBhdGggb3BhY2l0eT0iMC40IiBkPSJNNzQuNzE5OCA3NS42NTExQzc0LjYzMzMgNzUuNjUxMiA3NC41NDgyIDc1LjYyOTYgNzQuNDcyMiA3NS41ODgzQzc0LjQwMTYgNzUuNTQ2MSA3NC4zNDMyIDc1LjQ4NjIgNzQuMzAyNyA3NS40MTQ3Qzc0LjI2MjMgNzUuMzQzMSA3NC4yNDExIDc1LjI2MjIgNzQuMjQxMiA3NS4xOFY1Ny4zMzczQzc0LjI0MTIgNTcuMTcxIDc0LjMzMzYgNTcuMDE1OCA3NC40NzIyIDU2LjkyOUw5MC4yMzk3IDQ3Ljk4NTVDOTAuMzExOSA0Ny45NDM4IDkwLjM5MzggNDcuOTIxOSA5MC40NzcxIDQ3LjkyMTlDOTAuNTYwNSA0Ny45MjE5IDkwLjY0MjQgNDcuOTQzOCA5MC43MTQ2IDQ3Ljk4NTVDOTAuNzg3NiA0OC4wMjU1IDkwLjg0ODUgNDguMDg0MiA5MC44OTExIDQ4LjE1NTdDOTAuOTMzNyA0OC4yMjcyIDkwLjk1NjMgNDguMzA4OCA5MC45NTY2IDQ4LjM5MlY2Ni4yMzI4QzkwLjk1NyA2Ni4zMTY0IDkwLjkzNDcgNjYuMzk4NSA5MC44OTIxIDY2LjQ3MDRDOTAuODQ5NSA2Ni41NDI0IDkwLjc4ODEgNjYuNjAxNCA5MC43MTQ2IDY2LjY0MTFMNzQuOTUyNiA3NS41ODgzQzc0Ljg4MjUgNzUuNjMwNyA3NC44MDE4IDc1LjY1MjUgNzQuNzE5OCA3NS42NTExIiBmaWxsPSJ3aGl0ZSIvPgo8ZGVmcz4KPGxpbmVhckdyYWRpZW50IGlkPSJwYWludDBfbGluZWFyXzY4N18zNDU0IiB4MT0iMTYxIiB5MT0iMTgwIiB4Mj0iMy41OTI4NGUtMDciIHkyPSI0Ljk5OTk4IiBncmFkaWVudFVuaXRzPSJ1c2VyU3BhY2VPblVzZSI+CjxzdG9wLz4KPHN0b3Agb2Zmc2V0PSIxIiBzdG9wLWNvbG9yPSIjNTk1NjU2Ii8+CjwvbGluZWFyR3JhZGllbnQ+CjxjbGlwUGF0aCBpZD0iY2xpcDBfNjg3XzM0NTQiPgo8cmVjdCB3aWR0aD0iOTQiIGhlaWdodD0iOTQiIGZpbGw9IndoaXRlIiB0cmFuc2Zvcm09InRyYW5zbGF0ZSgyNSAyNSkiLz4KPC9jbGlwUGF0aD4KPC9kZWZzPgo8L3N2Zz4K
-    keysOrder: [["apiVersion"], ["appVersion"], ["kind"], ["metadata"], ["metadata", "name"], ["spec", "external"], ["spec", "externalMethod"], ["spec", "externalPorts"], ["spec", "externalAllowICMP"], ["spec", "runStrategy"], ["spec", "instanceType"], ["spec", "instanceProfile"], ["spec", "disks"], ["spec", "networks"], ["spec", "subnets"], ["spec", "gpus"], ["spec", "cpuModel"], ["spec", "resources"], ["spec", "sshKeys"], ["spec", "cloudInit"], ["spec", "cloudInitSeed"]]
+    keysOrder: [["apiVersion"], ["appVersion"], ["kind"], ["metadata"], ["metadata", "name"], ["spec", "external"], ["spec", "externalMethod"], ["spec", "externalPorts"], ["spec", "runStrategy"], ["spec", "instanceType"], ["spec", "instanceProfile"], ["spec", "disks"], ["spec", "networks"], ["spec", "subnets"], ["spec", "gpus"], ["spec", "cpuModel"], ["spec", "resources"], ["spec", "sshKeys"], ["spec", "cloudInit"], ["spec", "cloudInitSeed"]]
   secrets:
     exclude: []
     include: []
diff --git a/pkg/cmd/server/start.go b/pkg/cmd/server/start.go
index 7ebbbc89..f7791332 100644
--- a/pkg/cmd/server/start.go
+++ b/pkg/cmd/server/start.go
@@ -160,34 +160,6 @@ func (o *CozyServerOptions) Complete() error {
 	// Convert to ResourceConfig
 	o.ResourceConfig = &config.ResourceConfig{}
 	for _, crd := range crdList.Items {
-		release := config.ReleaseConfig{
-			Prefix: crd.Spec.Release.Prefix,
-			Labels: crd.Spec.Release.Labels,
-			ChartRef: config.ChartRefConfig{
-				Kind:      crd.Spec.Release.ChartRef.Kind,
-				Name:      crd.Spec.Release.ChartRef.Name,
-				Namespace: crd.Spec.Release.ChartRef.Namespace,
-			},
-		}
-		// Per-Application HelmRelease Install/Upgrade timeout. Applications
-		// whose parent chart contains asynchronously-provisioned resources
-		// the chart itself depends on (for example, the Kamaji-provisioned
-		// admin-kubeconfig Secret for Kubernetes tenants) need a longer
-		// wait budget than the Flux default. Consumed by the REST storage
-		// layer when building the HelmRelease Spec. The parser rejects
-		// units Flux would reject at webhook time, so a bad annotation
-		// surfaces as a loud startup failure instead of a silent drop to
-		// defaults.
-		d, err := config.ParseHelmInstallTimeoutAnnotation(
-			crd.Annotations[config.HelmInstallTimeoutAnnotation],
-		)
-		if err != nil {
-			return fmt.Errorf(
-				"ApplicationDefinition %q has invalid %s annotation: %w",
-				crd.Name, config.HelmInstallTimeoutAnnotation, err,
-			)
-		}
-		release.HelmInstallTimeout = d
 		resource := config.Resource{
 			Application: config.ApplicationConfig{
 				Kind:          crd.Spec.Application.Kind,
@@ -196,7 +168,15 @@ func (o *CozyServerOptions) Complete() error {
 				ShortNames:    []string{}, // TODO: implement shortnames
 				OpenAPISchema: crd.Spec.Application.OpenAPISchema,
 			},
-			Release: release,
+			Release: config.ReleaseConfig{
+				Prefix: crd.Spec.Release.Prefix,
+				Labels: crd.Spec.Release.Labels,
+				ChartRef: config.ChartRefConfig{
+					Kind:      crd.Spec.Release.ChartRef.Kind,
+					Name:      crd.Spec.Release.ChartRef.Name,
+					Namespace: crd.Spec.Release.ChartRef.Namespace,
+				},
+			},
 		}
 		o.ResourceConfig.Resources = append(o.ResourceConfig.Resources, resource)
 	}
diff --git a/pkg/config/config.go b/pkg/config/config.go
index 21de27b2..1e123e2c 100644
--- a/pkg/config/config.go
+++ b/pkg/config/config.go
@@ -16,48 +16,6 @@ limitations under the License.
 
 package config
 
-import (
-	"fmt"
-	"regexp"
-	"time"
-)
-
-// HelmInstallTimeoutAnnotation is the ApplicationDefinition metadata
-// annotation key that overrides the Flux HelmRelease Install.Timeout and
-// Upgrade.Timeout for a given Application kind.
-const HelmInstallTimeoutAnnotation = "release.cozystack.io/helm-install-timeout"
-
-// helmTimeoutPattern mirrors the CRD validation pattern used by Flux
-// helm-controller on HelmReleaseSpec.Install.Timeout (ms/s/m/h units only).
-// time.ParseDuration accepts ns/us/µs, but Flux rejects them - parsing here
-// with the same shape avoids feeding the controller a value it will later
-// reject at webhook time. See
-// github.com/fluxcd/helm-controller/api/v2 HelmReleaseSpec.Install.Timeout
-// in the go module cache.
-var helmTimeoutPattern = regexp.MustCompile(`^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$`)
-
-// ParseHelmInstallTimeoutAnnotation parses the value of the
-// release.cozystack.io/helm-install-timeout annotation. The empty string is
-// treated as "unset" and returns (0, nil) so callers can leave
-// HelmInstallTimeout zeroed and let flux defaults apply. Values accepted by
-// time.ParseDuration but rejected by Flux (ns/us/µs) return a helpful
-// error instead of silently parsing and failing later at HelmRelease
-// admission.
-func ParseHelmInstallTimeoutAnnotation(raw string) (time.Duration, error) {
-	if raw == "" {
-		return 0, nil
-	}
-	if !helmTimeoutPattern.MatchString(raw) {
-		return 0, fmt.Errorf("must match %s (Flux accepts ms/s/m/h units only), got %q",
-			helmTimeoutPattern, raw)
-	}
-	d, err := time.ParseDuration(raw)
-	if err != nil {
-		return 0, fmt.Errorf("time.ParseDuration(%q): %w", raw, err)
-	}
-	return d, nil
-}
-
 // ResourceConfig represents the structure of the configuration file.
 type ResourceConfig struct {
 	Resources []Resource `yaml:"resources"`
@@ -83,12 +41,6 @@ type ReleaseConfig struct {
 	Prefix   string            `yaml:"prefix"`
 	Labels   map[string]string `yaml:"labels"`
 	ChartRef ChartRefConfig    `yaml:"chartRef"`
-	// HelmInstallTimeout overrides the Flux HelmRelease Install.Timeout and
-	// Upgrade.Timeout for this Application kind. When zero, flux defaults
-	// apply. Populated from the
-	// release.cozystack.io/helm-install-timeout annotation on the
-	// ApplicationDefinition at start-up.
-	HelmInstallTimeout time.Duration `yaml:"helmInstallTimeout,omitempty"`
 }
 
 // ChartRefConfig references a Flux source artifact for the Helm chart.
diff --git a/pkg/config/config_test.go b/pkg/config/config_test.go
deleted file mode 100644
index eb6990af..00000000
--- a/pkg/config/config_test.go
+++ /dev/null
@@ -1,119 +0,0 @@
-package config
-
-import (
-	"strings"
-	"testing"
-	"time"
-)
-
-// Cover the annotation parser used by cozystack-api at startup. The parser
-// is consumed by pkg/cmd/server/start.go on every ApplicationDefinition; a
-// typo here silently drops back to flux defaults and the Kubernetes tenant
-// race described in cozystack#2412 reappears, so the table must exercise:
-// - the unset path (empty string treated as "no override"),
-// - every unit Flux accepts (ms, s, m, h),
-// - compound forms (the CRD pattern accepts repeats),
-// - units time.ParseDuration accepts but Flux rejects (ns, us, µs),
-// - outright garbage.
-func TestParseHelmInstallTimeoutAnnotation(t *testing.T) {
-	cases := []struct {
-		name     string
-		input    string
-		want     time.Duration
-		wantErr  bool
-		errMatch string
-	}{
-		{
-			name:  "empty string leaves flux defaults in place",
-			input: "",
-			want:  0,
-		},
-		{
-			name:  "minutes",
-			input: "15m",
-			want:  15 * time.Minute,
-		},
-		{
-			name:  "hours",
-			input: "1h",
-			want:  time.Hour,
-		},
-		{
-			name:  "seconds",
-			input: "45s",
-			want:  45 * time.Second,
-		},
-		{
-			name:  "milliseconds",
-			input: "500ms",
-			want:  500 * time.Millisecond,
-		},
-		{
-			name:  "compound hour and minutes",
-			input: "2h30m",
-			want:  2*time.Hour + 30*time.Minute,
-		},
-		{
-			name:  "decimal minutes",
-			input: "1.5m",
-			want:  90 * time.Second,
-		},
-		{
-			name:     "nanoseconds rejected - Flux CRD pattern excludes ns",
-			input:    "500ns",
-			wantErr:  true,
-			errMatch: "Flux accepts ms/s/m/h units only",
-		},
-		{
-			name:     "microseconds rejected - Flux CRD pattern excludes us",
-			input:    "500us",
-			wantErr:  true,
-			errMatch: "Flux accepts ms/s/m/h units only",
-		},
-		{
-			name:     "microseconds unicode rejected",
-			input:    "500µs",
-			wantErr:  true,
-			errMatch: "Flux accepts ms/s/m/h units only",
-		},
-		{
-			name:     "bare digits rejected",
-			input:    "15",
-			wantErr:  true,
-			errMatch: "Flux accepts ms/s/m/h units only",
-		},
-		{
-			name:     "garbage rejected",
-			input:    "abc",
-			wantErr:  true,
-			errMatch: "Flux accepts ms/s/m/h units only",
-		},
-		{
-			name:     "negative rejected",
-			input:    "-15m",
-			wantErr:  true,
-			errMatch: "Flux accepts ms/s/m/h units only",
-		},
-	}
-
-	for _, tc := range cases {
-		t.Run(tc.name, func(t *testing.T) {
-			got, err := ParseHelmInstallTimeoutAnnotation(tc.input)
-			if tc.wantErr {
-				if err == nil {
-					t.Fatalf("expected error, got duration=%v", got)
-				}
-				if tc.errMatch != "" && !strings.Contains(err.Error(), tc.errMatch) {
-					t.Errorf("error %q does not contain %q", err.Error(), tc.errMatch)
-				}
-				return
-			}
-			if err != nil {
-				t.Fatalf("unexpected error: %v", err)
-			}
-			if got != tc.want {
-				t.Errorf("got %v, want %v", got, tc.want)
-			}
-		})
-	}
-}
diff --git a/pkg/registry/apps/application/rest.go b/pkg/registry/apps/application/rest.go
index d233ecc3..0728ea13 100644
--- a/pkg/registry/apps/application/rest.go
+++ b/pkg/registry/apps/application/rest.go
@@ -1528,24 +1528,6 @@ func (r *REST) convertApplicationToHelmRelease(app *appsv1alpha1.Application) (*
 		},
 	}
 
-	// Per-Application HelmRelease wait budget. The mechanism is generic:
-	// an ApplicationDefinition that sets
-	// release.cozystack.io/helm-install-timeout gets Install.Timeout and
-	// Upgrade.Timeout populated from ReleaseConfig.HelmInstallTimeout
-	// (parsed at startup). Applications that leave it unset keep flux
-	// defaults so their failed installs remediate on the normal cadence.
-	// Today only kubernetes-rd carries the annotation because the
-	// Kubernetes Application's parent chart contains CAPI/Kamaji
-	// resources whose admin-kubeconfig Secret is provisioned
-	// asynchronously and Kamaji cold-start routinely exceeds flux's
-	// default wait budget; any future kind with the same shape can opt
-	// in by setting the same annotation.
-	if r.releaseConfig.HelmInstallTimeout > 0 {
-		timeout := metav1.Duration{Duration: r.releaseConfig.HelmInstallTimeout}
-		helmRelease.Spec.Install.Timeout = &timeout
-		helmRelease.Spec.Upgrade.Timeout = &timeout
-	}
-
 	return helmRelease, nil
 }
 
diff --git a/pkg/registry/apps/application/rest_timeout_test.go b/pkg/registry/apps/application/rest_timeout_test.go
deleted file mode 100644
index 85ac0b97..00000000
--- a/pkg/registry/apps/application/rest_timeout_test.go
+++ /dev/null
@@ -1,116 +0,0 @@
-package application
-
-import (
-	"testing"
-	"time"
-
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-
-	appsv1alpha1 "github.com/cozystack/cozystack/pkg/apis/apps/v1alpha1"
-	"github.com/cozystack/cozystack/pkg/config"
-)
-
-func newRESTForTimeout(kind, prefix string, helmInstallTimeout time.Duration) *REST {
-	return &REST{
-		kindName: kind,
-		releaseConfig: config.ReleaseConfig{
-			Prefix: prefix,
-			ChartRef: config.ChartRefConfig{
-				Kind:      "HelmChart",
-				Name:      "x",
-				Namespace: "cozy-system",
-			},
-			HelmInstallTimeout: helmInstallTimeout,
-		},
-	}
-}
-
-// Table-driven: every Application kind carries a per-CRD HelmRelease wait
-// budget. The Kubernetes kind's parent chart contains CAPI/Kamaji resources
-// whose admin-kubeconfig Secret is provisioned asynchronously, so its
-// ApplicationDefinition sets release.cozystack.io/helm-install-timeout=15m
-// (or longer). Other kinds leave the annotation unset and keep flux defaults
-// so their failed installs remediate on the normal cadence. The test must
-// cover both paths: a kind with the timeout set and one without.
-func TestConvertApplicationToHelmRelease_AppliesReleaseConfigTimeout(t *testing.T) {
-	cases := []struct {
-		name       string
-		kind       string
-		prefix     string
-		configured time.Duration
-		wantSet    bool
-	}{
-		{
-			name:       "Kubernetes kind with 15m configured gets Install and Upgrade Timeout",
-			kind:       "Kubernetes",
-			prefix:     "kubernetes-",
-			configured: 15 * time.Minute,
-			wantSet:    true,
-		},
-		{
-			// Fictional kind on purpose: the test is about the unset path
-			// regardless of which real Application kind ends up needing a
-			// timeout override. Using a real kind name would create false
-			// coupling to that Application's ApplicationDefinition.
-			name:       "unrelated kind without configured timeout keeps flux defaults",
-			kind:       "PlaceholderKindForDefaults",
-			prefix:     "placeholder-",
-			configured: 0,
-			wantSet:    false,
-		},
-		{
-			name:       "arbitrary future kind with 20m configured gets 20m",
-			kind:       "TalosCluster",
-			prefix:     "talos-",
-			configured: 20 * time.Minute,
-			wantSet:    true,
-		},
-	}
-
-	for _, tc := range cases {
-		t.Run(tc.name, func(t *testing.T) {
-			r := newRESTForTimeout(tc.kind, tc.prefix, tc.configured)
-			app := &appsv1alpha1.Application{
-				ObjectMeta: metav1.ObjectMeta{Name: "example", Namespace: "tenant-root"},
-			}
-
-			hr, err := r.convertApplicationToHelmRelease(app)
-			if err != nil {
-				t.Fatalf("convertApplicationToHelmRelease returned error: %v", err)
-			}
-
-			if hr.Spec.Install == nil || hr.Spec.Upgrade == nil {
-				t.Fatalf("Spec.Install/Upgrade must be non-nil")
-			}
-
-			if tc.wantSet {
-				if hr.Spec.Install.Timeout == nil {
-					t.Fatalf("Spec.Install.Timeout must be set when HelmInstallTimeout=%v", tc.configured)
-				}
-				if hr.Spec.Install.Timeout.Duration != tc.configured {
-					t.Errorf("Spec.Install.Timeout = %v, want %v", hr.Spec.Install.Timeout.Duration, tc.configured)
-				}
-				if hr.Spec.Upgrade.Timeout == nil {
-					t.Fatalf("Spec.Upgrade.Timeout must be set when HelmInstallTimeout=%v", tc.configured)
-				}
-				if hr.Spec.Upgrade.Timeout.Duration != tc.configured {
-					t.Errorf("Spec.Upgrade.Timeout = %v, want %v", hr.Spec.Upgrade.Timeout.Duration, tc.configured)
-				}
-			} else {
-				if hr.Spec.Install.Timeout != nil {
-					t.Errorf("Spec.Install.Timeout must be nil when HelmInstallTimeout=0, got %v", hr.Spec.Install.Timeout.Duration)
-				}
-				if hr.Spec.Upgrade.Timeout != nil {
-					t.Errorf("Spec.Upgrade.Timeout must be nil when HelmInstallTimeout=0, got %v", hr.Spec.Upgrade.Timeout.Duration)
-				}
-			}
-
-			if hr.Spec.Install.Remediation == nil || hr.Spec.Install.Remediation.Retries != -1 {
-				t.Errorf("Spec.Install.Remediation.Retries must remain -1, got %+v", hr.Spec.Install.Remediation)
-			}
-			if hr.Spec.Upgrade.Remediation == nil || hr.Spec.Upgrade.Remediation.Retries != -1 {
-				t.Errorf("Spec.Upgrade.Remediation.Retries must remain -1, got %+v", hr.Spec.Upgrade.Remediation)
-			}
-		})
-	}
-}
diff --git a/pkg/registry/core/tenantnamespace/rest.go b/pkg/registry/core/tenantnamespace/rest.go
index 4ee97eb0..f1ed3fab 100644
--- a/pkg/registry/core/tenantnamespace/rest.go
+++ b/pkg/registry/core/tenantnamespace/rest.go
@@ -17,8 +17,6 @@ import (
 	apierrors "k8s.io/apimachinery/pkg/api/errors"
 	metainternal "k8s.io/apimachinery/pkg/apis/meta/internalversion"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/fields"
-	"k8s.io/apimachinery/pkg/labels"
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/runtime/schema"
 	"k8s.io/apimachinery/pkg/types"
@@ -26,7 +24,6 @@ import (
 	"k8s.io/apimachinery/pkg/watch"
 	"k8s.io/apiserver/pkg/endpoints/request"
 	"k8s.io/apiserver/pkg/registry/rest"
-	"k8s.io/klog/v2"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 
 	corev1alpha1 "github.com/cozystack/cozystack/pkg/apis/core/v1alpha1"
@@ -126,18 +123,8 @@ func (r *REST) Get(
 		return nil, apierrors.NewNotFound(r.gvr.GroupResource(), name)
 	}
 
-	// Check if user has access to this namespace
-	hasAccess, err := r.hasAccessToNamespace(ctx, name)
-	if err != nil {
-		return nil, err
-	}
-	if !hasAccess {
-		// Return Forbidden to follow standard K8s RBAC behavior
-		return nil, apierrors.NewForbidden(r.gvr.GroupResource(), name, fmt.Errorf("access denied"))
-	}
-
 	ns := &corev1.Namespace{}
-	err = r.c.Get(ctx, types.NamespacedName{Namespace: "", Name: name}, ns, &client.GetOptions{Raw: opts})
+	err := r.c.Get(ctx, types.NamespacedName{Namespace: "", Name: name}, ns, &client.GetOptions{Raw: opts})
 	if err != nil {
 		return nil, err
 	}
@@ -156,33 +143,11 @@ func (r *REST) Get(
 // -----------------------------------------------------------------------------
 
 func (r *REST) Watch(ctx context.Context, opts *metainternal.ListOptions) (watch.Interface, error) {
-	// Extract user identity once for the lifetime of the watch — it does not
-	// change between events and rebuilding it per event is wasteful.
-	u, ok := request.UserFrom(ctx)
-	if !ok {
-		return nil, apierrors.NewUnauthorized("user missing in context")
-	}
-	username := u.GetName()
-	groups := make(map[string]struct{})
-	for _, group := range u.GetGroups() {
-		groups[group] = struct{}{}
-	}
-
 	nsList := &corev1.NamespaceList{}
-
-	// Build upstream watch options with field and label selectors
-	rawOpts := &metav1.ListOptions{
+	nsWatch, err := r.w.Watch(ctx, nsList, &client.ListOptions{Raw: &metav1.ListOptions{
 		Watch:           true,
 		ResourceVersion: opts.ResourceVersion,
-	}
-	if opts.FieldSelector != nil {
-		rawOpts.FieldSelector = opts.FieldSelector.String()
-	}
-	if opts.LabelSelector != nil {
-		rawOpts.LabelSelector = opts.LabelSelector.String()
-	}
-
-	nsWatch, err := r.w.Watch(ctx, nsList, &client.ListOptions{Raw: rawOpts})
+	}})
 	if err != nil {
 		return nil, err
 	}
@@ -224,30 +189,6 @@ func (r *REST) Watch(ctx context.Context, opts *metainternal.ListOptions) (watch
 				continue
 			}
 
-			// Apply defensive filtering for field and label selectors
-			if opts.FieldSelector != nil {
-				if !opts.FieldSelector.Matches(fields.Set{"metadata.name": ns.Name}) {
-					continue
-				}
-			}
-			if opts.LabelSelector != nil {
-				if !opts.LabelSelector.Matches(labels.Set(ns.Labels)) {
-					continue
-				}
-			}
-
-			// Check if user has access to this namespace using the cached
-			// identity — avoids re-extracting user/groups on every event.
-			hasAccess, err := r.hasAccessToNamespaceForUser(ctx, ns.Name, username, groups)
-			if err != nil {
-				klog.ErrorS(err, "Failed to check access for namespace in watch", "namespace", ns.Name)
-				continue
-			}
-			if !hasAccess {
-				// User doesn't have access, skip this event
-				continue
-			}
-
 			out := &corev1alpha1.TenantNamespace{
 				TypeMeta: metav1.TypeMeta{
 					APIVersion: corev1alpha1.SchemeGroupVersion.String(),
@@ -368,26 +309,6 @@ func (r *REST) makeList(src *corev1.NamespaceList, allowed []string) *corev1alph
 	return out
 }
 
-// matchesSubject checks if a RoleBinding subject matches the user's identity.
-// It handles Group, User, and ServiceAccount subjects with proper namespace fallback.
-func matchesSubject(subj rbacv1.Subject, bindingNamespace, username string, groups map[string]struct{}) bool {
-	switch subj.Kind {
-	case "Group":
-		_, ok := groups[subj.Name]
-		return ok
-	case "User":
-		return subj.Name == username
-	case "ServiceAccount":
-		saNamespace := subj.Namespace
-		if saNamespace == "" {
-			saNamespace = bindingNamespace
-		}
-		return username == fmt.Sprintf("system:serviceaccount:%s:%s", saNamespace, subj.Name)
-	default:
-		return false
-	}
-}
-
 func (r *REST) filterAccessible(
 	ctx context.Context,
 	names []string,
@@ -426,9 +347,22 @@ func (r *REST) filterAccessible(
 	subjectLoop:
 		for j := range rbs.Items[i].Subjects {
 			subj := rbs.Items[i].Subjects[j]
-			if matchesSubject(subj, rbs.Items[i].Namespace, u.GetName(), groups) {
-				allowedNameSet[rbs.Items[i].Namespace] = struct{}{}
-				break subjectLoop
+			switch subj.Kind {
+			case "Group":
+				if _, ok = groups[subj.Name]; ok {
+					allowedNameSet[rbs.Items[i].Namespace] = struct{}{}
+					break subjectLoop
+				}
+			case "User":
+				if subj.Name == u.GetName() {
+					allowedNameSet[rbs.Items[i].Namespace] = struct{}{}
+					break subjectLoop
+				}
+			case "ServiceAccount":
+				if u.GetName() == fmt.Sprintf("system:serviceaccount:%s:%s", subj.Namespace, subj.Name) {
+					allowedNameSet[rbs.Items[i].Namespace] = struct{}{}
+					break subjectLoop
+				}
 			}
 		}
 	}
@@ -439,60 +373,6 @@ func (r *REST) filterAccessible(
 	return allowed, nil
 }
 
-// hasAccessToNamespace checks if the user has access to a single namespace.
-// This is optimized for Get/Watch operations where we check one namespace at a time.
-// It lists RoleBindings only in the target namespace instead of all cluster RoleBindings.
-func (r *REST) hasAccessToNamespace(
-	ctx context.Context,
-	namespace string,
-) (bool, error) {
-	u, ok := request.UserFrom(ctx)
-	if !ok {
-		return false, fmt.Errorf("user missing in context")
-	}
-	groups := make(map[string]struct{})
-	for _, group := range u.GetGroups() {
-		groups[group] = struct{}{}
-	}
-	return r.hasAccessToNamespaceForUser(ctx, namespace, u.GetName(), groups)
-}
-
-// hasAccessToNamespaceForUser is the inner check that does not re-extract user
-// identity from context. Use this in hot paths (e.g. the Watch loop) where the
-// caller has already cached the user name and groups.
-func (r *REST) hasAccessToNamespaceForUser(
-	ctx context.Context,
-	namespace, username string,
-	groups map[string]struct{},
-) (bool, error) {
-	// Check privileged groups
-	if _, ok := groups["system:masters"]; ok {
-		return true, nil
-	}
-	if _, ok := groups["cozystack-cluster-admin"]; ok {
-		return true, nil
-	}
-
-	// List RoleBindings only in the target namespace
-	rbs := &rbacv1.RoleBindingList{}
-	err := r.c.List(ctx, rbs, client.InNamespace(namespace))
-	if err != nil {
-		return false, fmt.Errorf("failed to list rolebindings in %s: %w", namespace, err)
-	}
-
-	// Check if user is in any RoleBinding subjects
-	for i := range rbs.Items {
-		for j := range rbs.Items[i].Subjects {
-			subj := rbs.Items[i].Subjects[j]
-			if matchesSubject(subj, rbs.Items[i].Namespace, username, groups) {
-				return true, nil
-			}
-		}
-	}
-
-	return false, nil
-}
-
 // -----------------------------------------------------------------------------
 // Boiler-plate
 // -----------------------------------------------------------------------------
diff --git a/pkg/registry/core/tenantnamespace/rest_test.go b/pkg/registry/core/tenantnamespace/rest_test.go
index 52d2a075..7f2979bc 100644
--- a/pkg/registry/core/tenantnamespace/rest_test.go
+++ b/pkg/registry/core/tenantnamespace/rest_test.go
@@ -3,20 +3,10 @@
 package tenantnamespace
 
 import (
-	"context"
 	"testing"
 
 	corev1 "k8s.io/api/core/v1"
-	rbacv1 "k8s.io/api/rbac/v1"
-	apierrors "k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	"k8s.io/apiserver/pkg/authentication/user"
-	"k8s.io/apiserver/pkg/endpoints/request"
-	"sigs.k8s.io/controller-runtime/pkg/client/fake"
-
-	corev1alpha1 "github.com/cozystack/cozystack/pkg/apis/core/v1alpha1"
 )
 
 func TestMakeListSortsAlphabetically(t *testing.T) {
@@ -48,466 +38,3 @@ func TestMakeListSortsAlphabetically(t *testing.T) {
 		}
 	}
 }
-
-// Security tests for IDOR fix
-
-func TestHasAccessToNamespace_WithUserAccess(t *testing.T) {
-	scheme := runtime.NewScheme()
-	_ = corev1.AddToScheme(scheme)
-	_ = rbacv1.AddToScheme(scheme)
-
-	ns := &corev1.Namespace{
-		ObjectMeta: metav1.ObjectMeta{Name: "tenant-test"},
-	}
-
-	rb := &rbacv1.RoleBinding{
-		ObjectMeta: metav1.ObjectMeta{
-			Name:      "test-binding",
-			Namespace: "tenant-test",
-		},
-		Subjects: []rbacv1.Subject{
-			{Kind: "User", Name: "test-user", APIGroup: "rbac.authorization.k8s.io"},
-		},
-		RoleRef: rbacv1.RoleRef{
-			APIGroup: "rbac.authorization.k8s.io",
-			Kind:     "Role",
-			Name:     "test-role",
-		},
-	}
-
-	client := fake.NewClientBuilder().
-		WithScheme(scheme).
-		WithObjects(ns, rb).
-		Build()
-
-	r := &REST{
-		c:   client,
-		gvr: schema.GroupVersionResource{Group: "core.cozystack.io", Version: "v1alpha1", Resource: "tenantnamespaces"},
-	}
-
-	u := &user.DefaultInfo{
-		Name:   "test-user",
-		Groups: []string{"system:authenticated"},
-	}
-	ctx := request.WithUser(context.Background(), u)
-
-	hasAccess, err := r.hasAccessToNamespace(ctx, "tenant-test")
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	if !hasAccess {
-		t.Error("expected user to have access, but got false")
-	}
-}
-
-func TestHasAccessToNamespace_WithoutAccess(t *testing.T) {
-	scheme := runtime.NewScheme()
-	_ = corev1.AddToScheme(scheme)
-	_ = rbacv1.AddToScheme(scheme)
-
-	ns := &corev1.Namespace{
-		ObjectMeta: metav1.ObjectMeta{Name: "tenant-test"},
-	}
-
-	// RoleBinding for different user
-	rb := &rbacv1.RoleBinding{
-		ObjectMeta: metav1.ObjectMeta{
-			Name:      "test-binding",
-			Namespace: "tenant-test",
-		},
-		Subjects: []rbacv1.Subject{
-			{Kind: "User", Name: "other-user", APIGroup: "rbac.authorization.k8s.io"},
-		},
-		RoleRef: rbacv1.RoleRef{
-			APIGroup: "rbac.authorization.k8s.io",
-			Kind:     "Role",
-			Name:     "test-role",
-		},
-	}
-
-	client := fake.NewClientBuilder().
-		WithScheme(scheme).
-		WithObjects(ns, rb).
-		Build()
-
-	r := &REST{
-		c:   client,
-		gvr: schema.GroupVersionResource{Group: "core.cozystack.io", Version: "v1alpha1", Resource: "tenantnamespaces"},
-	}
-
-	u := &user.DefaultInfo{
-		Name:   "test-user",
-		Groups: []string{"system:authenticated"},
-	}
-	ctx := request.WithUser(context.Background(), u)
-
-	hasAccess, err := r.hasAccessToNamespace(ctx, "tenant-test")
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	if hasAccess {
-		t.Error("expected user to NOT have access, but got true")
-	}
-}
-
-func TestHasAccessToNamespace_WithGroupAccess(t *testing.T) {
-	scheme := runtime.NewScheme()
-	_ = corev1.AddToScheme(scheme)
-	_ = rbacv1.AddToScheme(scheme)
-
-	ns := &corev1.Namespace{
-		ObjectMeta: metav1.ObjectMeta{Name: "tenant-test"},
-	}
-
-	rb := &rbacv1.RoleBinding{
-		ObjectMeta: metav1.ObjectMeta{
-			Name:      "test-binding",
-			Namespace: "tenant-test",
-		},
-		Subjects: []rbacv1.Subject{
-			{Kind: "Group", Name: "test-group", APIGroup: "rbac.authorization.k8s.io"},
-		},
-		RoleRef: rbacv1.RoleRef{
-			APIGroup: "rbac.authorization.k8s.io",
-			Kind:     "Role",
-			Name:     "test-role",
-		},
-	}
-
-	client := fake.NewClientBuilder().
-		WithScheme(scheme).
-		WithObjects(ns, rb).
-		Build()
-
-	r := &REST{
-		c:   client,
-		gvr: schema.GroupVersionResource{Group: "core.cozystack.io", Version: "v1alpha1", Resource: "tenantnamespaces"},
-	}
-
-	u := &user.DefaultInfo{
-		Name:   "test-user",
-		Groups: []string{"system:authenticated", "test-group"},
-	}
-	ctx := request.WithUser(context.Background(), u)
-
-	hasAccess, err := r.hasAccessToNamespace(ctx, "tenant-test")
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	if !hasAccess {
-		t.Error("expected user to have access via group, but got false")
-	}
-}
-
-func TestHasAccessToNamespace_SystemMasters(t *testing.T) {
-	scheme := runtime.NewScheme()
-	_ = corev1.AddToScheme(scheme)
-	_ = rbacv1.AddToScheme(scheme)
-
-	ns := &corev1.Namespace{
-		ObjectMeta: metav1.ObjectMeta{Name: "tenant-test"},
-	}
-
-	client := fake.NewClientBuilder().
-		WithScheme(scheme).
-		WithObjects(ns).
-		Build()
-
-	r := &REST{
-		c:   client,
-		gvr: schema.GroupVersionResource{Group: "core.cozystack.io", Version: "v1alpha1", Resource: "tenantnamespaces"},
-	}
-
-	u := &user.DefaultInfo{
-		Name:   "admin",
-		Groups: []string{"system:masters"},
-	}
-	ctx := request.WithUser(context.Background(), u)
-
-	hasAccess, err := r.hasAccessToNamespace(ctx, "tenant-test")
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	if !hasAccess {
-		t.Error("expected system:masters to have access, but got false")
-	}
-}
-
-func TestHasAccessToNamespace_CozyAdminGroup(t *testing.T) {
-	scheme := runtime.NewScheme()
-	_ = corev1.AddToScheme(scheme)
-	_ = rbacv1.AddToScheme(scheme)
-
-	ns := &corev1.Namespace{
-		ObjectMeta: metav1.ObjectMeta{Name: "tenant-test"},
-	}
-
-	client := fake.NewClientBuilder().
-		WithScheme(scheme).
-		WithObjects(ns).
-		Build()
-
-	r := &REST{
-		c:   client,
-		gvr: schema.GroupVersionResource{Group: "core.cozystack.io", Version: "v1alpha1", Resource: "tenantnamespaces"},
-	}
-
-	u := &user.DefaultInfo{
-		Name:   "cozy-admin",
-		Groups: []string{"cozystack-cluster-admin"},
-	}
-	ctx := request.WithUser(context.Background(), u)
-
-	hasAccess, err := r.hasAccessToNamespace(ctx, "tenant-test")
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	if !hasAccess {
-		t.Error("expected cozystack-cluster-admin to have access, but got false")
-	}
-}
-
-func TestHasAccessToNamespace_ServiceAccount(t *testing.T) {
-	scheme := runtime.NewScheme()
-	_ = corev1.AddToScheme(scheme)
-	_ = rbacv1.AddToScheme(scheme)
-
-	ns := &corev1.Namespace{
-		ObjectMeta: metav1.ObjectMeta{Name: "tenant-test"},
-	}
-
-	rb := &rbacv1.RoleBinding{
-		ObjectMeta: metav1.ObjectMeta{
-			Name:      "test-binding",
-			Namespace: "tenant-test",
-		},
-		Subjects: []rbacv1.Subject{
-			{Kind: "ServiceAccount", Name: "test-sa", Namespace: "tenant-test"},
-		},
-		RoleRef: rbacv1.RoleRef{
-			APIGroup: "rbac.authorization.k8s.io",
-			Kind:     "Role",
-			Name:     "test-role",
-		},
-	}
-
-	client := fake.NewClientBuilder().
-		WithScheme(scheme).
-		WithObjects(ns, rb).
-		Build()
-
-	r := &REST{
-		c:   client,
-		gvr: schema.GroupVersionResource{Group: "core.cozystack.io", Version: "v1alpha1", Resource: "tenantnamespaces"},
-	}
-
-	u := &user.DefaultInfo{
-		Name:   "system:serviceaccount:tenant-test:test-sa",
-		Groups: []string{"system:authenticated"},
-	}
-	ctx := request.WithUser(context.Background(), u)
-
-	hasAccess, err := r.hasAccessToNamespace(ctx, "tenant-test")
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	if !hasAccess {
-		t.Error("expected service account to have access, but got false")
-	}
-}
-
-func TestHasAccessToNamespace_ServiceAccountEmptyNamespace(t *testing.T) {
-	scheme := runtime.NewScheme()
-	_ = corev1.AddToScheme(scheme)
-	_ = rbacv1.AddToScheme(scheme)
-
-	ns := &corev1.Namespace{
-		ObjectMeta: metav1.ObjectMeta{Name: "tenant-test"},
-	}
-
-	// ServiceAccount subject with empty namespace should default to RoleBinding namespace
-	rb := &rbacv1.RoleBinding{
-		ObjectMeta: metav1.ObjectMeta{
-			Name:      "test-binding",
-			Namespace: "tenant-test",
-		},
-		Subjects: []rbacv1.Subject{
-			{Kind: "ServiceAccount", Name: "test-sa", Namespace: ""}, // Empty namespace
-		},
-		RoleRef: rbacv1.RoleRef{
-			APIGroup: "rbac.authorization.k8s.io",
-			Kind:     "Role",
-			Name:     "test-role",
-		},
-	}
-
-	client := fake.NewClientBuilder().
-		WithScheme(scheme).
-		WithObjects(ns, rb).
-		Build()
-
-	r := &REST{
-		c:   client,
-		gvr: schema.GroupVersionResource{Group: "core.cozystack.io", Version: "v1alpha1", Resource: "tenantnamespaces"},
-	}
-
-	u := &user.DefaultInfo{
-		Name:   "system:serviceaccount:tenant-test:test-sa",
-		Groups: []string{"system:authenticated"},
-	}
-	ctx := request.WithUser(context.Background(), u)
-
-	hasAccess, err := r.hasAccessToNamespace(ctx, "tenant-test")
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	if !hasAccess {
-		t.Error("expected service account with empty namespace to have access, but got false")
-	}
-}
-
-func TestGet_WithAccess(t *testing.T) {
-	scheme := runtime.NewScheme()
-	_ = corev1.AddToScheme(scheme)
-	_ = rbacv1.AddToScheme(scheme)
-
-	ns := &corev1.Namespace{
-		ObjectMeta: metav1.ObjectMeta{Name: "tenant-test"},
-	}
-
-	rb := &rbacv1.RoleBinding{
-		ObjectMeta: metav1.ObjectMeta{
-			Name:      "test-binding",
-			Namespace: "tenant-test",
-		},
-		Subjects: []rbacv1.Subject{
-			{Kind: "User", Name: "test-user", APIGroup: "rbac.authorization.k8s.io"},
-		},
-		RoleRef: rbacv1.RoleRef{
-			APIGroup: "rbac.authorization.k8s.io",
-			Kind:     "Role",
-			Name:     "test-role",
-		},
-	}
-
-	client := fake.NewClientBuilder().
-		WithScheme(scheme).
-		WithObjects(ns, rb).
-		Build()
-
-	r := &REST{
-		c:   client,
-		gvr: schema.GroupVersionResource{Group: "core.cozystack.io", Version: "v1alpha1", Resource: "tenantnamespaces"},
-	}
-
-	u := &user.DefaultInfo{
-		Name:   "test-user",
-		Groups: []string{"system:authenticated"},
-	}
-	ctx := request.WithUser(context.Background(), u)
-
-	obj, err := r.Get(ctx, "tenant-test", &metav1.GetOptions{})
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	tn, ok := obj.(*corev1alpha1.TenantNamespace)
-	if !ok {
-		t.Fatalf("expected *TenantNamespace, got %T", obj)
-	}
-	if tn.Name != "tenant-test" {
-		t.Errorf("expected name %q, got %q", "tenant-test", tn.Name)
-	}
-	if tn.Kind != "TenantNamespace" {
-		t.Errorf("expected Kind=TenantNamespace, got %q", tn.Kind)
-	}
-	if tn.APIVersion != corev1alpha1.SchemeGroupVersion.String() {
-		t.Errorf("expected APIVersion=%q, got %q", corev1alpha1.SchemeGroupVersion.String(), tn.APIVersion)
-	}
-}
-
-func TestGet_WithoutAccess(t *testing.T) {
-	scheme := runtime.NewScheme()
-	_ = corev1.AddToScheme(scheme)
-	_ = rbacv1.AddToScheme(scheme)
-
-	ns := &corev1.Namespace{
-		ObjectMeta: metav1.ObjectMeta{Name: "tenant-test"},
-	}
-
-	// RoleBinding for different user
-	rb := &rbacv1.RoleBinding{
-		ObjectMeta: metav1.ObjectMeta{
-			Name:      "test-binding",
-			Namespace: "tenant-test",
-		},
-		Subjects: []rbacv1.Subject{
-			{Kind: "User", Name: "other-user", APIGroup: "rbac.authorization.k8s.io"},
-		},
-		RoleRef: rbacv1.RoleRef{
-			APIGroup: "rbac.authorization.k8s.io",
-			Kind:     "Role",
-			Name:     "test-role",
-		},
-	}
-
-	client := fake.NewClientBuilder().
-		WithScheme(scheme).
-		WithObjects(ns, rb).
-		Build()
-
-	r := &REST{
-		c:   client,
-		gvr: schema.GroupVersionResource{Group: "core.cozystack.io", Version: "v1alpha1", Resource: "tenantnamespaces"},
-	}
-
-	u := &user.DefaultInfo{
-		Name:   "test-user",
-		Groups: []string{"system:authenticated"},
-	}
-	ctx := request.WithUser(context.Background(), u)
-
-	obj, err := r.Get(ctx, "tenant-test", &metav1.GetOptions{})
-	if err == nil {
-		t.Fatal("expected error, got nil")
-	}
-	if obj != nil {
-		t.Errorf("expected nil object, got %v", obj)
-	}
-
-	// Verify it returns Forbidden to follow standard K8s RBAC behavior
-	if !apierrors.IsForbidden(err) {
-		t.Errorf("expected Forbidden error, got %v", err)
-	}
-}
-
-func TestGet_NonTenantNamespace(t *testing.T) {
-	scheme := runtime.NewScheme()
-	_ = corev1.AddToScheme(scheme)
-	_ = rbacv1.AddToScheme(scheme)
-
-	client := fake.NewClientBuilder().
-		WithScheme(scheme).
-		Build()
-
-	r := &REST{
-		c:   client,
-		gvr: schema.GroupVersionResource{Group: "core.cozystack.io", Version: "v1alpha1", Resource: "tenantnamespaces"},
-	}
-
-	u := &user.DefaultInfo{
-		Name:   "test-user",
-		Groups: []string{"system:masters"},
-	}
-	ctx := request.WithUser(context.Background(), u)
-
-	obj, err := r.Get(ctx, "default", &metav1.GetOptions{})
-	if err == nil {
-		t.Fatal("expected error for non-tenant namespace, got nil")
-	}
-	if obj != nil {
-		t.Errorf("expected nil object, got %v", obj)
-	}
-	if !apierrors.IsNotFound(err) {
-		t.Errorf("expected NotFound error, got %v", err)
-	}
-}